Content Security Policy -- http://en.wikipedia.org/wiki/Content_Security_Policy

basically headers that can tell the browser not to execute stuff that leads to injection like inline javascript or inline styling, allows for whitelists of domains (so the browser won't run script src="http://hackercdn.com/malicious.js"), etc.