It really states which chars aren't allowed. The square brackets are required. The following string represents one word in the typical username. Basically, a word is either an atom or quoted string. In this tip, excerpted from InformIT , Michelle Johnston, e-business expert, talks about security considerations in the technical design of your site.
Security is a massive topic.
To be effective, the security policy of an organization must be enforced at every level of the technical architecture, and must be reinforced via business policies and procedures. Web server hardware should be kept in a secure room, free of environment hazards, with access controls, air conditioning, and so on. Network configurations and password control should be effectively managed and monitored. Audit logs should be kept of all failed attempts to gain access to the system. Virus-checking software should be installed on file servers, hard disks, and so on before any device or computer is allowed access to the network.