PHP preg_replace RCE

Question

I was building a code to sanitize user's input but while doing some searches on google i found out that the function that i used (preg_replace) can lead to remote command execution.

However my code is different from the ones that i found on google and stackoverflow

Is it still RCE'able?

    function ft($a,$b=""){
    $a = preg_replace("/[^a-zA-Z0-9".$b."]/", "", $a);
    return $a;
}

function fo($a){
    $a=ft($a,".@_-");
    return $a;
}


$test = $_GET["input"];
$func = fo($test);