diff --git a/www/tiqr/tiqr.php b/www/tiqr/tiqr.php
index bc7a8320..605d1a5e 100644
--- a/www/tiqr/tiqr.php
+++ b/www/tiqr/tiqr.php
@@ -118,7 +118,7 @@ function register( $enrollmentSecret, $secret, $notificationType, $notificationA
                 break;
             case "login":
                 $sessionKey = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['sessionKey']);
-                $userId = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['userId']);
+                $userId = preg_replace("/[^a-zA-Z0-9_-]+/", "", $_POST['userId']);
                 $response = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['response']);
                 logger()->addInfo(sprintf("received authentication response (%s) from user '%s' for session '%s'", $response, $userId, $sessionKey));
                 $result = login( $sessionKey, $userId, $response );