diff --git a/course/tests/externallib_test.php b/course/tests/externallib_test.php
index 4c1c85a97ab..43139bc4b5e 100644
--- a/course/tests/externallib_test.php
+++ b/course/tests/externallib_test.php
@@ -582,7 +582,9 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
         $label = $this->getDataGenerator()->create_module('label', array('course' => $course->id,
             'intro' => $labeldescription));
         $labelcm = get_coursemodule_from_instance('label', $label->id);
-        $url = $this->getDataGenerator()->create_module('url', array('course' => $course->id));
+        $url = $this->getDataGenerator()->create_module('url', array('course' => $course->id,
+            'name' => 'URL: % & $ ../'));
+        $urlcm = get_coursemodule_from_instance('url', $url->id);
 
         // Set the required capabilities by the external function.
         $context = context_course::instance($course->id);
diff --git a/mod/url/lib.php b/mod/url/lib.php
index 1307eabae19..57c2345ddc7 100644
--- a/mod/url/lib.php
+++ b/mod/url/lib.php
@@ -315,7 +315,7 @@ function url_export_contents($cm, $baseurl) {
 
     $url = array();
     $url['type'] = 'url';
-    $url['filename']     = $urlrecord->name;
+    $url['filename']     = clean_param(format_string($urlrecord->name), PARAM_FILE);
     $url['filepath']     = null;
     $url['filesize']     = 0;
     $url['fileurl']      = $fullurl;