ASP.NET offers an extra layer to protect your application from XSS attacks and injection in general which is called Request validation.
On their official topic, they mention that:
Even if you're using request validation, you should HTML-encode text that you get from users before you display it on a page.
Assuming that a web application doesn't validate or sanitize any data sent to the server but does have the feature enabled, how could one bypass this extra layer to submit malicious code? Is this feature necessary for an ASP.NET application?