This is not SQL injection at all; you are not passing
$theVar to a SQL server, but to a shell command. Therefore,
mysql_real_escape_string is useless.
You need to employ
escapeshellarg, which applies the same concept to a shell string.
In this example,
$theVar = preg_replace("/[\"'%()@$.!&?_: #\/-]/","", mysql_real_escape_string($_GET['var']));
exec("zip -r archived.zip ./".$theVar."/");
you are not escaping the redirection characters < and >. So (for example) it is possible to overwrite any file that the process executing
zip has access to.
Even worse, you are not escaping the command separator character ; . So it is possible to add extra commands (as far as they don't use any of the forbidden characters) that will also be executed.
A better approach would be to see what characters are permissible in a file name, and only accept those, rejecting any string containing forbidden characters. If you allow wildcards (looks like you do), expand those yourself with
glob() to obtain a list of files, and check those files for permissions and location by translating each path to a unique canonical pathname using
Better still, do not allow wildcards. At that point it would also be easy to verify whether the requested file does indeed exist. Shell commands would mostly turn out to be invalid or nonexistent as file names, and be automatically rejected at no additional cost.