In general URIs as defined by RFC 3986
http://www.ietf.org/rfc/rfc3986.txt may contain any of the following characters: A-Z, a-z, 0-9, -, ., _, ~, :, /, ?, #, [, ], @, !, $, &, ', (, ), *, +, ,, ; and =. Any other character needs to be encoded with the percent-encoding (%hh). Each part of the URI has further restrictions about what characters need to be represented by an percent-encoded word.
However that list above doesn't define where in the URI those characters may reside. You can't have all of them just anywhere.. Some of those characters are reserved for a specific purpose.
If you research you will find that characters that are allowed in a URI but do not have a reserved purpose are called unreserved. These include
uppercase and lowercase letters, decimal digits, hyphen, period, underscore, and tilde.. These are the only characters you should use to create the ending SEO string.