Manual:$wgInvalidUsernameCharacters

Details
Characters to prevent during new account creations.

This is used in a regular expression character class during registration (regex metacharacters like / are escaped).