How do I allow spaces in this regex?

the \s in the regular expretion like this '/[^A-Za-z0-9_-\s]/'
mean the space

if(preg_match('/[^A-Za-z0-9_ -]/', $str)) return FALSE;

Note that I put the space before the hyphen. If the space were after the hyphen, I would be specifying a character range from underscore to space. (Issue also evadable by putting a backslash before the hyphen to escape it.)

This is assuming that what you mean by "allow" is: this regex is being used to validate a character string, and if it matches, then the character string is disallowed (hence return FALSE). So the characters in the negated character class ([^...]) are actually the allowed characters. (This is causing some general confusion in this question.)