Including a hyphen in a regex character bracket?

Escaping using \- should be fine, but you can also try putting it at the beginning or the end of the character class. This should work for you:

/^[a-zA-Z0-9._-]+$/