Why use a regex? Why not use htmlspecialchars()?
echo htmlspecialchars($str, ENT_NOQUOTES, 'UTF-8', false);
Pay attention to the fourth parameter. This means not to recode anything. Basically it will turn everything <into <, everything >into >and everything &that is not part of an existing object in&
But, if you must use a regex, you can do:
$regex = '/&([^\w;])/';
echo preg_replace($regex, '&\1', $str);
, -, ...