In our experience, FILTER_SANITIZE_STRING is incredibly useful for forms, since we don't find any justification to escape HTML when the input form is a single text input.
Even if, by any change JS code does land on the database, it's content is garbled because quotes, single quotes and < >'s are converted to the HTML equivalent. If we echo the field content as it is, the user will still be safe, because the tag is garbled in such a way that it will not run. Of course we can be wrong, but we have not encountered any issues directly related with the filter.
There are some keyboards that don't have the proper keyboard language, thus, the quotes they input in the fields, may or not result into curly quotes, which is a bane for reading back that string into the input field.
One may argue that the output from that particular string must be escaped, but why spending two extra lines of code escaping the output for N different outputs when you can just sanitize the string before inputting data in the database?
We have never heard that FILTER_SANITIZE_STRING had the goal of preventing XSS, since we don't quite use the filter for that specific task in mind.
On the link to "Don't try to sanitize" there is no mention of using FILTER_SANITIZE_STRING.
They give us an example ( which I modified a little ):
$name ="Robert'); DROP TABLE users;";
$query = "SELECT * FROM users WHERE name = '{$name}'";
echo $query;
This yields:
SELECT * FROM users WHERE name = 'Robert'); DROP TABLE users'
as expected, this is an SQL Injection.
But, if we filter it:
$name = filter_var("Robert'); DROP TABLE users",FILTER_SANITIZE_STRING);
$query = "SELECT * FROM users WHERE name = '{$name}'";
echo $query;
This yields:
SELECT * FROM users WHERE name = 'Robert'); DROP TABLE users'
We'll ending asking for a user name called "Robert'
); DROP TABLE users" and the query will return no results.
We do hope PHP maintainers will come around and see the usefulness of the filter and keep it. But if not, then we'll just have to use the polyfill