^- matches anything except dashes, which includes other characters than aren't allowed in domain names.
... min length 3, max length 20.
Make sure to verify this on the server side as well. Otherwise it'll only be slighlty more secure. You can use the same regex pattern as above in preg_match().