WordPress has a function to validate file names

And it’s quite simple sanitize_file_name( 'R@ndom Fi(l)e?!.txt' ) will become [email protected]

Official documentation sanitize_file_name