1. You don't need to strip out characters.

2. You certainly don't want to do this with a regex, you should let the database(driver) handle the data for you.

You should preferably use place holders (as mentioned in the post above) or use the $dbh->quote() mechanism if you really have to. No other way is going to be safe.