Have you tried double encode? For dot: %252e, for comma %252c or %82. Sometimes it works great. If you can not solve this problem, you can send me (under hide) a vulnerability, i will try to bypass.
Thanks bro, that's not how I used the double coding, you really helped!!!
