I would wager to say a large majority of .asp sites out there are vulnerable to these types of issues.

Most were coded before common sanitization and security practices were observed during dev, not to mention built in to frameworks.