All character are allowed for renaming tag-fields (like album artist, album, title,...) in Mp3tag.
If you want to rename filenames, use the $validate(filename,to) scripting function.
Example: $validate(%artist% - %album% - %track% - %title%,',')
This example replaces all invalid characters (/?*"<>|:) to commas like you want it.
why commas? wouldn't an underscore look somewhat better: $validate(%artist% - %album% - %track% - %title%,_)
Building that option into the web sources script would be possible, but I think it's not worth the work. I would have to change quite a lot for that. And the next question would be, disable those characters for all tag fields or only for some? If only for some, for what fields? So finally I would have to make an option for every tag field to diable those characters.