That is the point of escaping multiple periods in a row to become single periods. Running the URL through that preg_replace method will exchange all multiple occurrences with one. The method doesn't make it valid; it simply cleans it so that if someone is trying to escape, they *will* get a 404 if by chance there isn't a file with the single period names, but say the file was index.static.php, it will work.