The forbidden characters don't take into account that people can send custom packets to include malicious characters (web shell possible?)