WordPress has a function to validate file names

And it’s quite simple sanitize_file_name( 'R@ndom Fi(l)e?!.txt' ) will become R@ndom-File.txt

Official documentation sanitize_file_name