I couldn't get the ScanQueryString to work so I put the values that I wanted to block in the QueryString below [DenyQueryStringSequences] as follows:-
[DenyQueryStringSequences]
;
; If any character sequences listed here appear in the query
; string for any request, that request will be rejected.
;
< ; Commonly used by script injection attacks
> ; Commonly used by script injection attacks
--
%3b ; a semicolon
/*
@ ; also catches @@
char ; also catches nchar and varchar
alter
begin
cast
convert
create
cursor
declare
delete
drop
end
exec ; also catches execute
fetch
insert
kill
open
select
sys ; also catches sysobjects and syscolumns
table
update
seems to be working ok now. I couldn't find this problem covered anywhere else so if anyone has any further comments or suggestions please reply here or contact oliver at barrowvale dot com forward slash contact dot asp
Many Thanks
Oliver