\w stands for a-z, A-Z, 0-9 and the underscore (_) os it answers your question.
about your second question, of course you can limit the string's length, for example if a username length should be maximum 30 characters long than this will qualify:

/^[A-Za-z][-.\w]{29}$/
[download]

the first char is mandetory to be alphabetic and the 29 in braces replaces the '+' sign to note exact number of chars.

Hotshot