title: Why does ASP.NET dangerous request validation work this way?
body: <p>Can anyone point me in the right direction with the following question.</p>
  
  <p>The default "Dangerous Request" validation in ASP.NET prohibits inputs like</p>
  
  <pre><code>"&lt;p", "&lt;p&gt;" or "&lt;script&gt;"
  </code></pre>
  
  <p>but at the same time allows inputs like</p>
  
  <pre><code>"&lt;%script&gt;" or "&lt;.script&gt;"
  </code></pre>
  
  <p>What is the rational here?</p>