title: RegEx Whitelist Problem
body: <p>I'm a little confused. I am running all my inputs through a basic sanitize function I write to only allow certain characters, but characters such as <code>[]</code> are still being allowed.</p>
  
  <pre><code>function sanitize($input) {
  $pattern = "/[^a-zA-z0-9_-]/";
  $filtered = preg_replace($pattern, "", $input);
  return $filtered;}
  </code></pre>
  
  <p>Any idea why it's doing that?</p>