PDO valid characters for placeholders

The easiest way to find out, is to just check the source code:

BINDCHR     = [:][a-zA-Z0-9_]+;

You can use alphanumeric + underscore.

If I read the PDO SQL parser source code correctly, it's alphanumeric characters plus underscore.