How do I protect my database from malicious attacks while allowing punctuation marks?

[eluser]dottedquad[/eluser]
Hello all,
So far my regular expression reads: preg_match("/[\W]' '/", $str)) which allows alpha numeric characters and white spaces. However, I would like to allow other punctuation marks to allow for complete sentences without posing a threat to my database. Can someone give me a regular expression example allowing certain punctuation marks?

Thank You,
Rich