What are the safe characters for making URLs?

To quote section 2.3 of RFC 3986:

Characters that are allowed in a URI, but do not have a reserved purpose, are called unreserved. These include uppercase and lowercase letters, decimal digits, hyphen, period, underscore, and tilde.

  ALPHA  DIGIT  "-" / "." / "_" / "~"

Note that RFC 3986 lists fewer reserved punctuation marks than the older RFC 2396.

There are two sets of characters you need to watch out for: reserved and unsafe.

The reserved characters are:

• ampersand ("&")
• dollar ("$")
• plus sign ("+")
• comma (",")
• forward slash ("/")
• colon (":")
• semi-colon (";")
• equals ("=")
• question mark ("?")
• 'At' symbol ("@")
• pound ("#").

The characters generally considered unsafe are:

• space (" ")
• less than and greater than ("<>")
• open and close brackets ("[]")
• open and close braces ("{}")
• pipe ("|")
• backslash ("\")
• caret ("^")
• percent ("%")

I may have forgotten one or more, which leads to me echoing Carl V's answer. In the long run you are probably better off using a "white list" of allowed characters and then encoding the string rather than trying to stay abreast of characters that are disallowed by servers and systems.

You are best keeping only some characters (whitelist) instead of removing certain characters (blacklist).

You can technically allow any character, just as long as you properly encode it. But, to answer in the spirit of the question, you should only allow these characters:

1. Lower case letters (convert upper case to lower)
2. Numbers, 0 through 9
3. A dash - or underscore _
4. Tilde ~

Everything else has a potentially special meaning. For example, you may think you can use +, but it can be replaced with a space. & is dangerous, too, especially if using some rewrite rules.

As with the other comments, check out the standards and specifications for complete details.

From the context you describe, I suspect that what you're actually trying to make is something called an 'SEO slug'. The best general known practice for those is:

1. Convert to lower-case
2. Convert entire sequences of characters other than a-z and 0-9 to one hyphen (-) (not underscores)
3. Remove 'stop words' from the URL, i.e. not-meaningfully-indexable words like 'a', 'an', and 'the'; Google 'stop words' for extensive lists

So, as an example, an article titled "The Usage of !@%$* to Represent Swearing In Comics" would get a slug of "usage-represent-swearing-comics".

From an SEO perspective, hyphens are preferred over underscores. Convert to lowercase, remove all apostrophes, then replace all non-alphanumeric strings of characters with a single hyphen. Trim excess hyphens off the start and finish.

The format for an URI is defined in RFC 3986. See section 3.3 for details.

I think you're looking for something like "URL encoding" - encoding a URL so that it's "safe" to use on the web:

Here's a reference for that. If you don't want any special characters, just remove any that require URL encoding:

HTML URL Encoding Reference