Its been a while since I did any ASP.Net, but I remember some sort of error that would be thrown by default for common sql injection or script injection patterns on user inputs. There were still many many ways to screw things up, but this probably prevented quite a few attacks for extra lazy/ignorant coders (we have all been there at one point or another).