I am trying to perform a [Path Traversal][1] attack on a very simple web only for educational purposes.

What I have to do is access a file named `passwords.txt` located in `\files\private\admin\passwords.txt`,  I am on `\files\public\` and the URL parameters are the following:

    /download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters `folder` and `file` to the path `\files\public\`. None of them are vulnerable to SQL Injection according to SQLMap, neither `action`. So, if I put:

    /download.php?folder=private\admin\&file=passwords.txt&action=download

 
The resulting path will be `\files\public\private\admin\passwords.txt`

I have tried the simplest trick like putting `\..\` (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce `..`.

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path `\files\public\` if I want access to that file (DBMS is MySQL).

Is is possible to delete the `\public\` part of the path using comments with `#` or another way so I can finally get access to the `private` directory?

  [1]: https://en.wikipedia.org/wiki/Directory_traversal_attack