Characters permitted by Security Filtering?

[eluser]NBrepresent[/eluser]
On the input/security library page of the docs, under the Security Filtering heading one of the bullet points is "Filters the POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters."

Exactly which characters are allowed?