Limiting the character set in this way (also called whitelisting) is one of the recommended methods of input validation. The purpose of input validation is to prevent a program from executing on data that may cause unintended problems.
There are many successful attacks that have resulted from malformed URLs (these are not actual attack URLs, but representative of attacks):
- filepath injection:
- buffer overflow:
- script injection:
- SQL injection:
http://example.com/?USER=' or 1=1; select * from users
Initial reactions to these attacks were to prohibit the backslash character, quote marks, asterisks, and the less-than and greater-than symbols. This is called blacklisting; unfortunately, blacklisting is mostly a "patch after learning about the attack" approach. Whitelisting is somewhat more effective than blacklisting. However, limiting the characters that appear in a URL may do virtually nothing to prevent many of these attacks if they can all be bypassed using percent encoding, which enables the attacker to use only characters from the approved white list: %2F is the same as a /, etc.
To be effective, the regexp in CodeIgniter needs to be performed after the percent encoding has been decoded. And in order to prevent buffer overflow problems while simply testing the data with regexp, the first step of the validator has to be length checking.
There's another problem that they might be trying to prevent with their whitelist, and that is URL hijacking using Unicode characters to simulate ASCII characters. To a human just clicking a link, the strings "exampleZurichBank.com" and "exampleZuricⱨBank.com appear similar. Blocking Unicode characters that aren't in the [A-Z][a-z] range does help prevent these; it also disenfranchises a large segment of the planet by blocking URLs in their native alphabets.
Keep in mind that input validation is only one preventative measure out of many that still need to be implemented. Applications still need to defend against other common vulnerabilities, such as XSS, CSRF, SQL injection, session hijacking, etc.