Your code looks okay (dispite the nonformatting). But you are using double negative logic. By using/[^a-zA-Z-0-9]/ with the leading '^' you are matching anything that is *not* in the that group. Then you are notting that result with the '!', so you are saying: If the user name has one character not not in a-zA-Z0-9_ then print error. Better stated: if username has a valid character print error.

By the way: /\W/ is the same as the above regex.

You need something like:

if($FORM{'username'} =~ /\W/))
{ 
  print  "Content-type: text/html\n\n"; 
  print " Error: spaces not allowed\n"; 
  exit;
} 
else { &proceed; }
[download]

where the \W means non word character (ie not a-zA-Z0-9_). So if the username matches a single non word character then print error.