a potentially dangerous request.path value was detected from the client (&)

a potentially dangerous request.path value was detected from the client (&). asp.net

<system.web>

    <httpRuntime requestPathInvalidCharacters="" requestValidationMode="2.0" />

    <pages validateRequest="false" />

</system.web>