Here are warnings of a few common security issues that can come up with respect to ASP use. Links for some good pointers. The Allaire Security Zone has bulletins and articles on many security issues. If you name all include files with a .ASP extension, your webserver will attempt to process them rather than just passing them directly to a person attempting to view them. Depending upon the contents, the page shown to the browser will be blank.
Some people use naming conventions such as filename.
INC.ASP or IncFileName. ASP to indicate which files are include files. Others use a specific directory for all include files, but use .asp as the file extension. People using Visual Interdev, HomeSite, and others sometimes save their work directly to the server. The problem arises when the package you are using creates a .BAK file when you save your work.