One way to "allow only" is to check for the characters which are not allowed. This can be done by checking the inverse set of the allowed characters. [^...] will do that.

if ($str =~ /[^[:alpha:][:digit:].]/) {
   die("Bad data\n");
}
[download]

The other way is to use [...] to check for allowed characters. But you need to make sure every character in the string is checked by anchoring the regexp with ^ and \z.

if (!($str =~ /^[[:alpha:][:digit:].]*\z/)) {
   die("Bad data\n");
}
[download]

Everything used here is documented in perlre.

Update: Switched to character classes. Original code in HTML comment.