Unfortunately, this is not the case, all transactions have to be closed anyway. 

In example below, I changed only one value and then used rollback, so, it changed it back and committed 

Missing TCOMMIT, would only mean, that transaction is still open, and it's a bad sign, which will be logged in messages.log, for a long opened transactions.

That means improper configuration for the webserver. Anything that goes through a CSP application goes this way.

Properly configured webserver, should take care of static files without IRIS, just process them itself.

In this case, IRIS will not even know about requests to the static files.

Remember, that you should not use a private Webserver in the production at all, and have to have something manually configured. And any newest IRIS non-community versions since 2023.2 will not even install a private webserver anymore unless the IRIS is updated from some previous version.

you can use $zstrip, where action *P, * is for any place, and P any punctuation

for example

USER>write $zstrip("before!@#$%^&*()_+\-=\[\]{};':""\\|,.<>\/?after", "*P")
beforeafter

And if you just want to check if the string contains any punctuations, you can compare if the original string does not equal the same after $zstrip.

if you wish to use regexp, you can use $match

USER>write $match(".!@", "^[!@#$%^&*()_+\-=\[\]{};':""\\|,.<>\/?]*$")
1