Regex to avoid SQL attack in username field

I know it isn't fool proof to use regex in username field however, I am using the regex below. I still think it isn't foolproof. I just had to stop all special chars..... But I really want to allow users to use hyphen & fullstop if they prefer. It seems ucweb adds space to username field automatically (this is also a problem). I used trim func in php but no way.... Someone pls edit this code below

if (preg_match('/[^\dA-Za-z\-\@\*\(\)\?\!\~\_\=\[\]]+/', $username))

{ echo "wrong inputs"; }

You should better use prepared statements, is not that different, it just adds a few more steps but totally worth it.

Did you know that simply using PDO or Prepared statements in mysqli will prevent SQLi? It wasn't designed to intentionally, but like all good programming practices, security was a byproduct! Who whudda thunkit?

If you read the top answer http://stackoverflow.com/questions/...statements-protect-from-sql-injection-attacks it gives a pretty good explanation.