It's also checking if it contains any characters other than the alphabet, a-z and A-Z, digits 0-9, and _.
Or you could say, checking that it only contains alphanumeric characters and _.
This could be rewritten to be simpler, too - preg_match returns an int, so there's no reason to use the 'return false, return true' pattern.
function isUserID($username){ return (bool)preg_match('/^[a-z\d_]{2,20}$/i', $username); }
Would do the same thing.
Also, \w
means the same thing as those characters. Letters, digits and underscore. So even better would be
function isUserID($username){ return (bool)preg_match('/^[\w]{2,20}$/i', $username); }