PARAM_FILE has been designed to remove dangerous characters or patterns from file names. It would be a good idea to create a function which cleans up file names so that they're compliant with most platforms.
This does not imply to strip out all characters but [a-z0-9_.-] but to replace some illegal ones with an underscore (? / \ *, etc ...) and to trim the extract spaces.
Zipping files is probably the trickiest part as we could end up with multiple files having the same name. We could also break things like an HTML document if those funky file names were used as references, but what can we do about it?