The correct approach is to accept [a-z][a-z0-9]* as identifiers and forbid everything else.