Manual:$wgInvalidUsernameCharacters

Details
Characters to prevent during new account creations.

The @ sign is prohibited by default, because MediaWiki uses it internally for users that have their account in another wiki (interwiki users). The : sign is prohibited because the validity of usernames in different wikis differs due to different namespace and interwiki configuration. If you allow the "@" in usernames, you should also set . Otherwise you won't be able to give users with an "@" in the username different permissions using the normal way (though permissions can still be set via user ID). However, you are free to allow the ":" in usernames as long as you don't run multiple wikis with shared database or Extension:CentralAuth, and you don't create new namespace or interwiki prefixes which make existing username invalid.

This is used in a regular expression character class during registration (regex metacharacters like / are escaped).

Example
In case user names containing @, # and € should be prevented, the following setting is used: