Question

To reduce an attacker’s possibilities, is it worth to have only alphanumeric values inside the table ? For example on username and password inputs on registration form applay the following:

preg_replace("/[^A-Za-z0-9 ]/", '', $input); 

And of course, perform the same each time before login ?

Answer 1

By removing any characters you’re actually weaken security.

there is absolutely no point in removing whatever characters, while some non alanum characters are required in passwords for better security

See my other answer on the “illegal” characters topic: https://stackoverflow.com/a/2995163/285587