There are only a few characters you can't put into a filename. The / is the only one I can think of.
It doesn't hurt to be strict though. This will force all characters to be a letter, number, or underscore (anything that isn't will be turned into an underscore):
$filename = preg_replace('/\W/', '_', $filename);