First of all, the prefix is only a configuration option and not a security feature.
The reason is that once an attacker has access to your database, he can find out any exisiting table prefix within seconds. There’s no way this obscurity
protects you from any attack.
For the prefix itself, WordPress asks you to use only digits, letters (here only basic Latin letters a-z are meant) and underscores. (This can be found inside a PHP comment in the wp-config-sample.php file right above the prefix declaration. In theory, with MySQL you can use almost every character in a object name as long as you quote the object name in any situation:
SELECT `über_col` from `über_table` …
Would be possible, however. For compatibility reasons (means: compatibility with queries that don’t quote their object names in backticks) you should follow the suggestion
inside wp-config-sample.php which follows basically the MySQL specification for unquoted object names.
Furthermore the specification points out, that a table name must not be longer than 64 characters. So basically its a good idea to keep the prefix short.
To be even compatible with SQLite, you should avoid a digit as first character of the prefix.
Conclusion
A table prefix:
- should only contain Latin letters (
a-z), digits (0-9) and underscores (_). - should not start with a digit (
0-9) - should not consists solely of digits
- should be as short as possible