Underscores are generally escaped in URLs in file fields in BibTeX, but many BibTeX processors allow both. What I've found works well is to require '\', ':', ';' and '{' and '}' to be escaped (as per above), and dimply allow anything else *plus* '\' followed by any char.