IIS SQL Injection Request Filtering

web.config

<filteringRules>
    <filteringRule name="SQLInjection" scanQueryString="true">
        <appliesTo>
            <clear />
            <add fileExtension=".asp" />
            <add fileExtension=".aspx" />
        </appliesTo>
        <denyStrings>
            <clear />
            <add string="@@version" />
            <add string="sqlmap" />
            <add string="Connect()" />
            <add string="cast(" />
            <add string="char(" />
            <add string="bchar(" />
            <add string="sysdatabases" />
            <add string="(select" />
            <add string="convert(" />
            <add string="DBNETLIB" />
            <add string="connect(" />
            <add string="int%2c(" />
            <add string="sysobjects" />
            <add string="count(" />
        </denyStrings>
        <scanHeaders>
            <clear />
        </scanHeaders>
    </filteringRule>
</filteringRules>