Possible solutions:
1) All non a-z A-Z 0-9 characters removed (can be done with regex). This includes spaces (the PHP command trim() will remove spaces at the start/end of names(strings))
2) All non a-z A-Z 0-9 characters converted to their URL safe form
3) A hash derived from the username used to view the profile.
Number 3 would be the easiest to implement that would allow anything to be entered, however creates none human recognisable URLs.
Number 1 would be the easiest that would leave the URLs as human readable.