The username is used a little bit everywhere, due to the way it is setup. What is actually done is a sha512 hash is created from the provided name and that is used further on.

If you look for `create the user` in the source code (default lines 193 to 198 in start.php):

%
        //create the user, if new:
        //- if registrations are allowed (`FORUM_NEWBIES` is true)
        //- you can’t create new users with the HTTP_AUTH sign in
        if (FORUM_NEWBIES && !isset ($_SERVER['PHP_AUTH_USER']) && !file_exists ($user))
                file_put_contents ($user, hash ('sha512', $name.PASS)) or require FORUM_LIB.'error_permissions.php'
        ;
%

This is where a new user will be stored on the server, by creating a file that has the sha512 hash of the user name as the filename.

I would think about expanding that `if` clause to do additional checks would allow you to introduce new limitations to usernames. E.g. add something like `strpbrk(NAME, " ") === false`. (strpbrk will return false when none of the provided characters are found, we only want to continue if spaces are not found to we need to compare with false.)

You can easily add other symbols you do not want to allow then, like maybe you want to block things that look like web addresses or email addresses: `strpbrk(NAME, " @:") === false`

I am not sure how to best communicate this error to the user though. It would just look like something randomly failed?