Security considerations for special characters in usernames? I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters.

I have read this answer which describes how that might be achieved (by overriding the form validation for creating/editing a user).

My question is: Would there be some security risk in allowing special characters such as &amp;/#?()+ in usernames, or did the Drupal developers make these characters illegal purely for aesthetic reasons?
I can think of three concerns when it comes to usernames and security: Cross Site Scripting (XSS), SQL Injection, and Homograph "attacks".

As long as you don't allow the &lt; and > in usernames then you don't have to worry about XSS. If you want to allow one or both of those then you need to be more suspicious and do a thorough test of your site for XSS by entering a malicious username and seeing what happens.

SQL Injection should not be a problem. This has largely been solved in Drupal for a while and DBTNG in Drupal 7 makes it even less common. You could still test for it with some weird usernames that contain '; and other character combinations.

Homograph is then the worst thing. For a while (maybe still) you could register a username like Admin which looks a lot like Admin but in fact uses the MATHEMATICAL BOLD CAPITAL A from the list of confusables. The problem would arise from someone using a username that is a homographic match to a known "admin" on your site to register on the site and then using the contact or private message feature of the site (or even a public node/comment) to trick other users of the site into doing something stupid (e.g. posting a message "Our site is having login problems, please go to http://sitename.evil.example/password-reset and enter your credentials to have your login fixed."). By adding more characters to the allowed set of username characters you make a homograph social-engineering attack more likely/easier. I don't consider this to be a big problem and you should consider whether this is really a problem for your site before worrying about it.

The Real Name module is meant to give you this ability without the form alter. I don't think it's really any safer for homograph attacks, though.