Right now, users can put anything. Literally.
Means that in theory they can add in Javascript into the page and do whatever the hell they want. That's the price of allowing just arbitrary input.
Regular expressions allow you to state what is allowed to be used, what characters are permitted and so on, so I'd be interested to know what characters are allowed in usernames for the sites so that bad input can be filtered out.