A null byte in a string can typically be treated as 'end of the string'. I'm assuming what happened, is that the expression filtering code stopped analyzing th

A null byte in a string can typically be treated as 'end of the string'. I'm assuming what happened, is that the expression filtering code stopped analyzing the string after the null byte, but other parts of the code continue past the null byte (eg, because the string indicates its length at the start of the string, which extends beyond the null byte) and the code that processes that (supposedly sanitized string) interprets beyond that null byte (to the payload).