Stripping out all illegal characters for a folder name

Folks, I'm taking some user input, and creating a folder on the server. I'm already replacing " " with "_", and stripping out a few known illegal characters (', ", /, \, etc). I need to be sure that I'm stripping out every character that cannot be used for a folder name. What's the best way to do this? Do I have to manually come up with a comprehensive list of illegal characters, and then str_replace() them one by one? There's gotta be a better way to do this... Joseph