Fwd: [CSS21] Unquoted url() syntax

Tokenization for unquoted url()s doesn't makes sense to me (from
http://www.w3.org/TR/CSS21/syndata.html#tokenization):

url\({w}([!#$%&*-\[\]-~]|{nonascii}|{escape})*{w}\)

Specifically, [!#$%&*-\[\]-~] confuses me. Is it meant to
be [^!#$%&*-\[\]-~]  (that is, all chars except !#$%&*-[]~ )? (Also note
that '-' is listed twice, is that significant or a typo?)

For some context, I am trying to to automatically generate CSS files and I
want to know which chars need to be escaped in unquoted url()s.
Specifically, are unescaped strings allowed? Both Chrome and Firefox do not
appear to allow spaces in unquoted url()s, but I can't tell what part of
the spec is precluding this.

Perhaps they are implementing CSS3 (from
http://www.w3.org/TR/css3-syntax/#tokenization):

urlchar ::= [#x9#x21#x23-#x26#x27-#x7E] | nonascii | escape

where space #x20 is not allowed? This spec is also confusing,
does #x23-#x26#x27-#x7E mean the same thing as #x23-#x7E? That is all chars
from '!' to '~' inclusive? Or is it a typo and #27 '\'' was meant to be
excluded?

Thanks,
-Shawn