http://blogs.technet.com/neilcar/archive/2008/10/31/sql-injection-hijinks.aspx

Neil Capenter shows another example of why ASP and using Black list is a really bad idea.

This is really interesting because it shows
"ASP drops a percent sign from the query string if it isn't followed by two valid hex characters(0-9, A-F) when it actually interprets it via Request.QueryString. "

Neil proves this in a test page it shows that the earlier attacks are again being updated to go past filters. If companies have patched a fix over this type of hole then they will be facing a more complete attack soon.

http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1697

The new version of URL scan specifically checks for this and is worth having in your toolkit.