On Unix and Unix-like OSs any character except the path delimiter can be used in filenames, including characters that have special meaning in HTML (like [<>&]) and non-printing characters including CARRIAGE RETURN and NEWLINE. It's a good idea to HTML escape filesystem object names and, depending on the intended use, include some indication of the presence of non-printing characters where they occur.