Well, shift+1 is an exclamation point -- not a terribly uncommon thing to type! (Unless you're referring to shift+[start of heading], which us un-type-able, I think.) Though Fang is right: form entry needs to be checked on the server-side.
To address the specific question though, see http://www.quirksmode.org/js/keys.html
So, my assumption is that you want to filter keys onkeypress using something like the following:
<input type='text' onkeypress='return filter()'; />
<script type='text/javascript'>
function filter(in_event) {
var e = in_event || window.event;
var typedChar = String.fromCharCode(e.charCode || e.keyCode);
if (typedChar.match(/a-zA-Z0-9/)) {
return true;
} else {
return false;
}
} // filter()
</script>
The above code is untested ... but I think that's generally the direction you want to take this. I actually might update my auto-completer code on svidgen.com with something like this later ... If I get around to that today, I'll post my code.