The dash needs to be the first/last character in the character class in order to be used literally:
^[-0-9a-zA-Z \/_?:.,\s]+$^[0-9a-zA-Z \/_?:.,\s-]+$
You could also escape it, if not the first/last:
^[0-9a-zA-Z\- \/_?:.,\s]+$
Simple answer, user \- in character class.
\-
Escape it with \ like:
^[\-0-9a-zA-Z \/_?:.,\s]+$