4
The following characters are prohibited in embedded image URLs: "()?&'<>
See MyTextSanitizer::xoopsCodeDecode, in class/module.textsanitizer.php.
When putting files on the web, I normally name them using only digits (0-9), lowercase letters (a-z), underscore (_), hyphen (-) and period (.).