Do you need to escape on: 'uploadImage.asp?filename=..\..\..\..\\' :?