Why does ASP.NET dangerous request validation work this way?

Question

Can anyone point me in the right direction with the following question.

The default "Dangerous Request" validation in ASP.NET prohibits inputs like

"<p", "<p>" or "<script>"

but at the same time allows inputs like

"<%script>" or "<.script>"

What is the rational here?

Answer 1

<p, <p> or <script>

These look like HTML/XML tags.

<%script> or <.script>

but these do not.

And the validation is trying to stop cross site scripting, eg. submitting a field containing:

<script>alert("You're powned!")</script>

(except truly malicious) and when you just write that text back to the user without being careful to encode correctly the user has just injected code into your website.