Preg_match pattern for user input filtering My users may need to supply a 'disease category' to my site. I need to let them use all alphanumeric characters, hyphens and single quotes. Would someone review this to see if they feel it's reasonable safe?  I'm very happy for suggestions to make it tighter,

      $disease_category = "some user input";
      $reg = "#[^'a-z0-9\s-]#i";
      preg_match($reg,$disease_category);
Well if having an underscore in your line could be acceptable, then

$reg = "#[^\w\s-']#i";


could be used. If you cannot have underscores, then

$reg = "#[^a-z\d\s-']#i";


could be correct.

A conditional using preg_match would be safe with this.