One way:

>perl -wMstrict -le
"my $ok = 'a-zA-Z0-9., ';
 ;;
 my $string = 'foo - bar & baz & boff';
 ;;
 (my $all_ok  = $string) =~ s{ [^$ok] }{}xmsg;
 (my $all_bad = $string) =~ s{ [$ok]  }{}xmsg;
 ;;
 print qq{these are ok: '$all_ok'};
 print qq{these are bad: '$all_bad'};
"
these are ok: 'foo  bar  baz  boff'
these are bad: '-&&'
[download]

Note that
    my $ok = 'a-zA-Z0-9., ';
appears in single quotes so that something like  \d (which is perfectly valid in a character class) will not be interpolated as a single literal 'd'.