I’ll never remember this, so I’ll brain dump it here.
Because iOS formats phone numbers as hyperlinks, I was seeing errors in the IIS event log saying “A potentially dangerous request was detected…” when I was doing an ajax post. The content I was trying to post was just a confirmation, so the phone number was held in a span rather than a textbox. It worked fine on all PC browsers and most mobile devices. Most of the posts I found on Stack Overflow and elsewhere talked about solving it by setting validateRequest on the page level to false. I didn’t want to do this, because I want that added security.
So here’s my fix: add a hidden input that holds the phone number as its value and post that rather than the content from the span.