A filename can't contain the character /
under Windows (or most other OSes), so you won't be able to stop that one getting converted. #
is left alone by most browsers, the odd one out being IE.
Content-Disposition
filenames are a bit limited. Non-ASCII characters aren't reliable in them and the proper escaping according to the RFC doesn't work. If you want to get Unicode characters into a default download filename—or certain other punctuation characters including #
in IE—you have to URL-encode it and include that as a trailing part of the path, omitting the Content-Disposition filename. eg:
http://www.example.com/myscript.aspx/foo%23bar.xls
myscript.aspx:
response.AddHeader("Content-Disposition", "attachment");
(You still can't include /
in a filename this way as web servers tend to block all URLs with %2F in. In any case, as above, you wouldn't be able to save it with a /
in the filename anyway.)