Colpa del bb code:
$isValid = (bool)preg_match('/^[A-Za-z0-9-_]{2,16}$/',$string);