Null byte attacks are alive and well

Null bytes still bypass validation because native code ends strings at the first zero byte while managed code does not: Java's .jpg filename check falls to %00, while ASP.NET rejects embedded nulls.