php regex or string check to make sure a variable contains specific characters -

i need make sure variable holds product id contains specific characters.

for integer-only variables i'm using is_numeric check.

but product id, variable can contain following characters:

• many numbers [0-9]
• the characters - (dash) and/or _ (underscore)
• it can contain letters "s" or "c" (but not together)

for example, valid: c23_2308724208_9873208, valid: 12-c53_09872807342, valid: s23_208320720. not valid: 12-2352'; select * administrators;.

i go format of variable don't think need long make sure variables consists of above. want put check protect sql injections. don't think need care format, i? want make sure given characters s,c,[0-9],[-,_] can found in variable, , nothing outside of range of valid characters.

edit

based on someone's comment format strictly followed, exact format follows:

• optional prefix of numbers , dash (eg. 132-)
• necessary letter (either s or c) followed numbers, underscore, more numbers (eg. s234_23872084732)
• optional suffix of underscore followed yet more numbers (so complete example case s234_23872084732_201874018743).

so if optional things there, 132-s234_23872084732_201874018743, , if necessary components there, s234_23872084732.

but technical point, why necessary follow strict regex? long make sure required characters there, sql injection impossible, right?

something like?

/^([0-9]+-|)[cs][0-9_]+$/i