There is no need for regular expressions! You can solve this using a simple str_replace
:
$payment_number = str_replace(array(" ", "-"), "", @$_SESSION['ccdata']['order_payment_number']);
In case you want to use regular expressions anyway, you only have to add the delimiters to make it PREG compatible:
$payment_number = preg_replace("/ |-/", "", @$_SESSION['ccdata']['order_payment_number']);