Turns out there's a reason XSS is so often mentioned. Even Dropbox and Facebook fell prey to it (although in this case the input wasn't from the web, but rather from their desktop application/service partner).
That's the fundamental mistake. Don't escape input, escape output. If you're interpolating values into queries, that's an output that you need to escape for. If you're sending data to a browser, that's another output that you need to escape for (with different escaping rules).
It's easy to get wrong - especially when you look through the list of different subtle ways you could mis-escape something [0].
The only thing protecting the majority of sites is that exploiting them just isn't desirable.
[0] https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_She...
print htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
Otherwise, yeah, someone will miss one instance and that's all it takes. One attack vector.