However, the code below allows spaces.
No, it doesn't. However, it will only match on input with a length of 1. For inputs with a length greater than or equal to 1, you need a +
following the character class:
var regexp = /^[a-zA-Z0-9-_]+$/;
var check = "checkme";
if (check.search(regexp) === -1)
{ alert('invalid'); }
else
{ alert('valid'); }
Note that neither the -
(in this instance) nor the _
need escaping.