You don't say whether a hyphen could start or end the string 🙂
A PCRE regexp for the job is
/(?<![-\d])(?=[-\d]{13})(?![-\d]{14})(\d*-\d+-\d+-\d*)/
The first bracketed section makes sure we don't have any hyphens or digits immediately to our left (it pins searches to the start of digit/hyphen groups and so prevents matching things like 0000000000000-0-00-0000).
The second makes sure there are at least 13 digits and hyphens immediately to our right (to make sure of course that it's long enough)
The third makes sure there aren't too many digits and hyphens.
The fourth bracketed expression is the match itself and is pretty self-explanatory as regexps go. If you dont' want hyphens at the start or end, change the appropriate * to a +.
Oh, and the second one is a P.O.P.
$string = preg_replace('/X(?=.)/','',$string)