When creating a new comment block, a client_id can be arbitrarily specified without needed for it be cleaned in any way, and no documentation on what characters are allowed. But, hyphens and underscores are trimmed when passed to comment_ajax.php.

This issue should either allow those characters, or clarify that they are not allowed.

Discovered in MDL-53347.