That will let commas through as well as letters and digits. Also, it will let "$@() Dfk" through, because that string contains letters.
For a regexp that matches strings that only letters, digits, underscores and (judging from your example) spaces:
/^[\w ]*$/
Means "the start of the string"
\w is PCRE shorthand for "letter, digit, or underscore"
* means "zero or more" of the preceeding
$ is the "end of the string".
So in other words the whole expression reads "The entire string, from beginning to end, is nothing except letters, digits, underscores and spaces".
PS. Also linked to this thread from here.