diff --git a/badges/badge.php b/badges/badge.php
index d21b96efb08..560bb88867a 100644
--- a/badges/badge.php
+++ b/badges/badge.php
@@ -42,6 +42,7 @@ $badge = new issued_badge($id);
 if (!empty($badge->recipient->id)) {
     if ($bake && ($badge->recipient->id == $USER->id)) {
         $name = str_replace(' ', '_', $badge->badgeclass['name']) . '.png';
+        $name = clean_param($name, PARAM_FILE);
         $filehash = badges_bake($id, $badge->badgeid, $USER->id, true);
         $fs = get_file_storage();
         $file = $fs->get_file_by_hash($filehash);
diff --git a/badges/classes/external.php b/badges/classes/external.php
index 25081bfcdd0..e5b2de0a2b9 100644
--- a/badges/classes/external.php
+++ b/badges/classes/external.php
@@ -159,7 +159,7 @@ class core_badges_external extends external_api {
                     new external_single_structure(
                         array(
                             'id' => new external_value(PARAM_INT, 'Badge id.', VALUE_OPTIONAL),
-                            'name' => new external_value(PARAM_FILE, 'Badge name.'),
+                            'name' => new external_value(PARAM_TEXT, 'Badge name.'),
                             'description' => new external_value(PARAM_NOTAGS, 'Badge description.'),
                             'badgeurl' => new external_value(PARAM_URL, 'Badge URL.'),
                             'timecreated' => new external_value(PARAM_INT, 'Time created.', VALUE_OPTIONAL),
diff --git a/badges/edit_form.php b/badges/edit_form.php
index cebc4830461..1c2a40aed31 100644
--- a/badges/edit_form.php
+++ b/badges/edit_form.php
@@ -48,8 +48,8 @@ class edit_details_form extends moodleform {
 
         $mform->addElement('header', 'badgedetails', get_string('badgedetails', 'badges'));
         $mform->addElement('text', 'name', get_string('name'), array('size' => '70'));
-        // Using PARAM_FILE to avoid problems later when downloading badge files.
-        $mform->setType('name', PARAM_FILE);
+        // When downloading badge, it will be necessary to clean the name as PARAM_FILE.
+        $mform->setType('name', PARAM_TEXT);
         $mform->addRule('name', null, 'required');
         $mform->addRule('name', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');
 
diff --git a/badges/mybadges.php b/badges/mybadges.php
index 8437ad46e6a..97c4aeee0bf 100644
--- a/badges/mybadges.php
+++ b/badges/mybadges.php
@@ -72,6 +72,7 @@ if ($hide) {
     require_sesskey();
     $badge = new badge($download);
     $name = str_replace(' ', '_', $badge->name) . '.png';
+    $name = clean_param($name, PARAM_FILE);
     $filehash = badges_bake($hash, $download, $USER->id, true);
     $fs = get_file_storage();
     $file = $fs->get_file_by_hash($filehash);
diff --git a/badges/tests/badgeslib_test.php b/badges/tests/badgeslib_test.php
index 0f1f6caeb9c..23ae6dc92a0 100644
--- a/badges/tests/badgeslib_test.php
+++ b/badges/tests/badgeslib_test.php
@@ -48,7 +48,7 @@ class core_badges_badgeslib_testcase extends advanced_testcase {
 
         $fordb = new stdClass();
         $fordb->id = null;
-        $fordb->name = "Test badge";
+        $fordb->name = "Test badge with 'apostrophe' and other friends (<>&@#)";
         $fordb->description = "Testing badges";
         $fordb->timecreated = time();
         $fordb->timemodified = time();
diff --git a/badges/tests/behat/add_badge.feature b/badges/tests/behat/add_badge.feature
index 8c0957316a4..d228bbc549a 100644
--- a/badges/tests/behat/add_badge.feature
+++ b/badges/tests/behat/add_badge.feature
@@ -31,14 +31,14 @@ Feature: Add badges to the system
   Scenario: Add a badge
     Given I navigate to "Add a new badge" node in "Site administration > Badges"
     And I set the following fields to these values:
-      | Name | Test Badge |
+      | Name | Test badge with 'apostrophe' and other friends (<>&@#) |
       | Description | Test badge description |
       | issuername | Test Badge Site |
       | issuercontact | testuser@example.com |
     And I upload "badges/tests/behat/badge.png" file to "Image" filemanager
     When I press "Create badge"
     Then I should see "Edit details"
-    And I should see "Test Badge"
+    And I should see "Test badge with 'apostrophe' and other friends (&@#)"
     And I should not see "Create badge"
     And I follow "Manage badges"
     And I should see "Number of badges available: 1"
diff --git a/lib/badgeslib.php b/lib/badgeslib.php
index 8c42e62845c..b1adc3f6c31 100644
--- a/lib/badgeslib.php
+++ b/lib/badgeslib.php
@@ -1161,6 +1161,7 @@ function badges_download($userid) {
         // Need to make image name user-readable and unique using filename safe characters.
         $name =  $badge->name . ' ' . userdate($issued->dateissued, '%d %b %Y') . ' ' . hash('crc32', $badge->id);
         $name = str_replace(' ', '_', $name);
+        $name = clean_param($name, PARAM_FILE);
         if ($file = $fs->get_file($context->id, 'badges', 'userbadge', $issued->badgeid, '/', $issued->uniquehash . '.png')) {
             $filelist[$name . '.png'] = $file;
         }