Sounds like you are running version 1.1 of ASP.NET / .NET Framework, which added a new security feature called request validation. Request validation looks at every request and determines if it could be a possible CSS (Cross Site Scripting) attack. By default Request Validation is on for every page.
If you wish to allow users to post arbitrary HTML to you site you need to turn off request validation:
<%@Page ValidateRequest='false' %>
For more information check out : Protecting Against Script Exploits in a Web Application on MSDN
Share with