There is no reason to implement your own sanitization logic in 2016. As Aria points out, you can just use mysqli_real_escape_string if you want to sanitize.
The key here is that this is NOT a 100% effective means of preventing SQLi.
The proper way would be to use the mysqli library to parameterize queries, because this renders first order injection impossible! You might see a lot of recommendations to use PDO to make prepared statements. It's important to note that prepared statements are not the same as parameterized queries. Prepared statements are just statements passed to a module that does the sanitization for you.
That's not to say sanitization isn't useful, it just isn't useful for preventing SQLi. You should still do it, though, to prevent stored cross site scripting. Strip out anything that a browser might recognize as HTML or JS or CSS if you're storing any untrusted input that might be displayed in a page.
TL;DR Parameterize your queries to protect from SQLi; prepare them to protect from stored XSS.
EDIT: I just noticed that your regexp doesn't seem to account for semicolons or dashes, so I could achieve injection against it quite easily.