The problem is the ^ "beginning-of-string" anchor at the beginning of your regex, and the $ "end-of-string" anchor at the end. It ends up meaning "if the entire string consists of invalid characters, delete the entire string". What I think you mean is "if there are any invalid characters in the string, replace them with nothing", which you get by simply removing the anchors:

$test1 =~ s/[^A-Za-z\-\ ]+//g;
[download]

By the way, if you're dealing with untrusted input and trying to avoid doing unsafe things with it, you should read about "taint mode" in perlsec.