Encoded url gives dangerous request exception

Question

I send by AJAX request to get users. Search is input entered by user on the form. Url which is send doesn't contain illegar chars. (I know that chars like ' or < or > are incorrect for email adress)

GET http://localhost:1294/Users/GetAll?search=%27test%27%2B%3Cinfo%2540test.pl%3E

query is encoded to protect XSS, but I get exception:

A potentially dangerous Request.QueryString value was detected 
from the client (search="...test' <test@test.pl>").

I don't understand why I get this exception despite I encoded data in url ?

Answer 1

You are using <> that is considered harmful even though it has been encoded before.

MSDN:

Request validation throws this exception when any HTML markup is detected, including harmless markup like <b> (bold) elements.