The first one is true because it does make a match. It is matching abcd. You did not tell the regular expression it had to match the entire string. You said it has to match any of those characters.
If you would add start of string [^] and end of string [$] to it, plus say it has to be there one or more time [+]
var reg=/^[0-9a-zA-Z\._-]+$/;
You would get false because it has to match the whole thing. What does it mean? It has to match any of those characters.
I really think you need to do some reading on this stuff.
Here is an article on them:
http://www.webreference.com/js/column5/ Eric