WordPress has a function to validate file names

And it’s quite simple sanitize_file_name( '[email protected] Fi(l)e?!.txt' ) will become [email protected]

Official documentation sanitize_file_name