It's hardcoded into the Input class in the function _clean_input_keys().
Just create a MY_Input class and override the function.
/**
* Clean Keys
*
* This is a helper function. To prevent malicious users
* from trying to exploit keys we make sure that keys are
* only named with alpha-numeric text and a few other items.
*
* @access private
* @param string
* @return string
*/
function _clean_input_keys($str)
{
// if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str)) <---- DEL
if ( ! preg_match("/^[#a-z0-9:_\/-]+$/i", $str)) // <----INS
{
exit('Disallowed Key Characters.');
}
// Clean UTF-8 if supported
if (UTF8_ENABLED === TRUE)
{
$str = $this->uni->clean_string($str);
}
return $str;
}