Null byte injection has been fixed in PHP 5.3.4 (which it's self is already an old and unsupported PHP version): https://bugs.php.net/bug.php?id=39863.
:http://security.stackexchange.com/questions/48187/null-byte-injection-on-php
:http://security.stackexchange.com/questions/48187/null-byte-injection-on-php