strstr() looks for one string inside another. If (as I thought
was meant) you want to detect any occurance of any of
the disallowed chars, something using a regex would be
more to the point, e.g.
if ( ereg( '[:/\-]', $string ))
echo "forbidden!";
Just in case the above doesn't work because of the backslashes,
that's a colon, forward slash, 2 backslashes (escape for a literal
backslash) and backslash-dash.