Just include /in the character class. But since you use it /as a regular expression terminator, you need to get away from it, as well \/:
$query = preg_replace('/[^-a-zA-Z0-9_\/]/', '', $query);
^^
You can make your regular expression shorter by using \winstead [a-zA-Z0-9_], and you can avoid escaping /with another delimiter ~::
$query = preg_replace('~[^-\w/]~', '', $query);