Rather a addslashes to avoid the injection (or the use of PDO, what we are doing with the v3).
The htmlspecialchars is to avoid xss or things like that, no?

And yes there are such protections, but do not hesitate to report in private the unprotected cases that you could find, if there are any left