My javascript regular expression does not work sometimes

Question

I am making an app within which users can create "posts" and "comments". Once these posts and comments are submitted they are sent by ajax to a php page and inserted to a database. They are then retrieved from the database and inserted to the page straight away without approval. I would like to have a strict Regular expression so that no harmful text can be submitted, however also allowing some unicode characters such as accented vowels. So my javascript regular expression is as follows:

postRegex = /^([A-Za-z0-9\u00C0-\u017F \/.,-_$!\'&*()="?#+%:;\[\]\r\r\n]{1,1000})$/;

My theory was If I disallow brackets such as < > then this could stop script tags being inserted. However when i try to submit text such as iframe embed code, to my surprise the form DOES submit.

<iframe width="100%" height="450" scrolling="no" frameborder="no" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/217462626&amp;auto_play=false&amp;hide_related=false&amp;show_comments=true&amp;show_user=true&amp;show_reposts=false&amp;visual=true"></iframe>

From my understanding of this regex I thought it would not let the <> brackets be submitted.

My regex does seem to be working though, as it does not submit the form when such characters as | are within the text. Is there an error in my regex?

Also can you give me advice if there is a better way to stop malicious content being inserted.

On the server side I am also sanitizing the content (before inserting to the database) as can be seen below in submit_post.php.

HTML form:

<form id="post_form" name="post_form" method="post" action="">                                      
        <label for="post_text"></label>     
        <textarea id="post_text" name="post_text" maxlength="1000" placeholder="Write your post here..."  rows="2" data-role="none" required></textarea>
</form>

Javascript and JQuery:

$("#post_form").on('submit', function(e){
        //this will execute when a post is submitted.
        e.preventDefault(); 
        var text_of_post  = $('#post_text').val();

        var postIsValid = validateInput(text_of_post, postRegex);
        if(!postIsValid){
            console.log('not valid');
            //content of form is not valid
        }else{
            //content of form is valid
            $.ajax({
            //do an ajax request passing along the user json web token for validation on server side and also the text that was submitted.
                url: app_root_url + 'submit_post.php',
                data: {'usertoken': token, 'text_of_post' : text_of_post},
                type: "POST",
                success: function(data){
                var result = JSON.parse(data);
                }
            });
    }

});

function validateInput(inputValue, regularExpression){
        var inputIsValid = regularExpression.test(inputValue);
        return inputIsValid;
}

PHP: submit_post.php

$postText = filter_var($_POST['text_of_post'], FILTER_SANITIZE_STRING);