Remove all html special chars
Similar to Toto's answer, I recommend:

function clean($var) {
    return preg_replace("~[^\w -]+~", "", $var);
}


This will replace all occurrences of one or more consecutive forbidden characters.

Adding the "one or more" (+) quantifier means longer potential matches and fewer total replacements.  IOW, imagine a carton of a dozen eggs on yhe ground.  If the task was to pick up 12 eggs, you could squat 12 times picking them up one at a time, or just squat once and pickup the carton.

I have eliminated the unnecessary inclusion of "single-use variables" as there is no benefit in retaining them for readability.

Following this custom function call, the call of htmlspecialchars() is useless because there won't be any chars to convert.

On the other hand, if you wanted to call htmlspecialchars_decode() prior to clean() there is reasonable logic to that decision, but it depends on the input that you are expecting.