I got hit with this very same attack over July 4th weekend. I inherited an abortion of a site written in "classic" ASP. The attacker inserted javascript links into every VARCHAR database table it could. Took me hours to clean out everything. Taking me even longer to go through and validate all the form posts.

People complain you ought to need a license to have a kid. This kind of crap makes me think you need a license to write a web app.