Let's analyze what is happening here by looking at ASP.NET WebForms code.
First example, w/o =1
[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22
System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693
System.Web.HttpValueCollection.GetValues(String name) +17
System.Web.UI.Page.DeterminePostBackMode() +99
If we run the code we can see that the exception originates in EnsureKeyValidated
but we can get there from GetValues
, from DeterminePostBackMode
. So if you check there we see this:
string[] values = nameValueCollection.GetValues((string) null);
so it's look like what we get here is retrieving all the values that are key-less. So the above query could be rewritten to the form null=<script>alert(313)</script>&
. So the script is passed to be the value for an null/empty key.
Second example, w/ =1
In here you're making the key to be equal to the script, and the value for that key to be 1. The key's are encoded before they are passed to the server so this would not be an issue.

If you want to replicate the error, you could pass a=<script>alert(313)</script>
and you would get the same error just originating from a different place:
[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (a="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22
System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693
System.Web.HttpValueCollection.GetValues(Int32 index) +29
System.Web.HttpValueCollection.ToString(Boolean urlencoded, IDictionary excludeKeys) +206
System.Web.UI.Page.get_ClientQueryString() +411
If you need to you can control what is being denied.