This is a pretty good list (although not exhaustive) of examples of where an attacker could implant code to compromise your website. It is a nice list because they also show which browsers the various injection attacks work in.

Here is the link to the sheet.
http://ha.ckers.org/xss.html