The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security

The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security in 2000, as an analyst for an org using classic ASP. maintaining security was a pain. I then started as a pentester in ~2005 and what I can tell you is, in my experience, classic ASP applications rarely had good protections against injection attacks (e.g. XSS, SQLi) for precisely the reason that the framework did not protect against it, leaving developers to make sure they had routines to canonicalise/sanitize/parameterize input correclty, and also that they implemented them universally across all possible user inputs. Whilst this isn't impossible, in my experience, it was rarely done perfectly. In comparison, something like ASP.Net which had in-built protections available, at least had the chance of having good uniform protection.