title: Are there global setting prevent the sql injection and XSS ? (ASP.NET)
body: <p>Are there global setting prevent the sql injection and XSS ?
  I'm using ASP.NET(web form)</p>
  
  <p>I know that there are some method can filter the special character ,
  and put it in the parameter string .</p>
  
  <p>but now I'm maintaining the source that not developing by myself,
  and the project is big, I don't want to change each sql command.</p>
  
  <pre><code>&lt;pages validateRequest="true" /&gt;
  </code></pre>
  
  <p>it's the web.config settings I find, can it prevent sql injection and XSS , it effective?</p>
  
  <p>thanks</p>