ajax file extention allow and wrong file .axd redirect on error page

<configuration>
<system.web>
    <trace enabled="false"/>
<pages viewStateEncryptionMode="Always" enableViewStateMac="false"></pages>
<compilation debug="true" targetFramework="4.0"/>
<customErrors mode="On" defaultRedirect="~/error.html">
<error statusCode="403" redirect="~/error.html"/>
<error statusCode="404" redirect="~/error.html"/>
<error statusCode="500" redirect="~/error.html"/>
</customErrors>
    <httpRuntime enableVersionHeader="false"/>
    <!--Below Added to secure cookie-->
    <httpCookies httpOnlyCookies="true" requireSSL="false"/>
    <!--Above Added to secure cookie-->
</system.web>
  <system.webServer>
  <!--The following configuration sample adds an HTTP "Cache-Control: no-cache" header to the response, thereby disabling caching of requests.-->
  <staticContent>
    <clientCache cacheControlMode="DisableCache" />
  </staticContent>
  <!--Above Added to HTTP "Cache-Control: no-cache" header to the response, thereby disabling caching of requests.-->
  </system.webServer>
<system.net>
<mailSettings>
<smtp>
<network host="localhost"/>
</smtp>
</mailSettings>
</system.net>
</configuration>

Rs. string format like 10,00,00,000.00 in .net

 int num=100000000;
 string oo = String.Format("{0:## ## ## ###.00}", num).Trim();
 oo = oo.Replace(' ', ',');

Security for page submit

using System;
using System.Collections.Generic;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using BusinessLogic;
using System.Net.Mail;
using System.Text;
using System.Configuration;

public partial class equity_opportunity_series : System.Web.UI.Page
{
    EquityOpportunity_Promo EQpromo = new EquityOpportunity_Promo();
 
    protected void Page_Load(object sender, EventArgs e)
    {
        if (!Page.IsPostBack)
        {
           
            Session["CheckRefreshA"] = Server.UrlDecode(System.DateTime.Now.ToString());
        }
    }
   #region Page Init
private void Page_Init(object sender, EventArgs e)
    {
        Page.ClientTarget = "uplevel";
    }

   #endregion
 #region Page Pre Render
    protected void Page_PreRender(object sender, EventArgs e)
    {
        ViewState["CheckRefreshA"] = Session["CheckRefreshA"];
    }
    #endregion
 
    protected void imgBtnSubmit_Click(object sender, EventArgs e)
    {
        try
        {

            if (Page.IsValid)
            {
                if (Session["CheckRefreshA"] != null)
                {
                    if (Session["CheckRefreshA"].ToString() == ViewState["CheckRefreshA"].ToString())
                    {
                     
                        Session["CheckRefreshA"] = Server.UrlDecode(System.DateTime.Now.ToString());
                     
                    }
                    else
                    {
                     
                    }
                }
            }
        }
        catch (Exception ex)
        {
            throw (ex);
        }
    }
 

 
}