If you are using .NET version 4.0. the validateRequestion is turned on by default for all the pages. in previous versions 1.1 and 2.0 it was only for aspx page. You can turn the default validation off. In that case you have to do the due diligence and make sure that the data is clean. Use HtmlEncode. Do the following to turn the validation off
In the web.config add the following lines for system.web
<httpRuntime requestValidationMode="2.0" />
and
<pages validateRequest="false" />
You can read more about this http://www.asp.net/learn/whitepapers/aspnet4/breaking-changes also http://msdn.microsoft.com/en-us/library/ff649310.aspx
Hope this helps.