I'll post the slides from my AntiXSS talk later, once I've cleaned them up. In the meantime, here's a couple of links:

• AntiXSS library (including the Security Runtime Engine)
• MarkAntiXSSOutput flag for the SRE
• XSS (Cross Site Scripting) Cheat Sheet - here's some examples of places you can inject script into HTML to get around filters that people write
• List of ASP.NET controls that need encoding

I will post the slides later.

Kirk