I can see validate_user() calls sanitize_user() with strict argument as true, which means uppercase letters are not allowed too.
In source code, I found this comment
// If strict, reduce to ASCII for max portability.
if ( $strict )
$username = preg_replace( '|[^a-z0-9 _.\-@]|i', '', $username );
I would like to know how does this affect portability?
imodifier in the regex pattern makes it case-insensitive, just something to note. – t31os Apr 8 '11 at 14:58