XSS Vulnerability 

Single and double quotes are not santized properly leading to an XSS vulnerability.
I personally would disallow all HTML by replacing xss_clean with htmlentities(STR, ENT_QUOTES),
as this will filter all kinds of evil, however you seem to allow some HTML.
My changes will mess up a user trying to enter <img src="http://url/HERE/" /> as the 
" will be changed into the entities, however this will stop the XSS.  
The attack I discovered in my development was:

<input type="text" value="VALUE_FROM_DB_HERE" name="field" />
If VALUE_FROM_DB_HERE =

d" onmouseover=alert(444); "
or more evil
d" onmouseover=eval($('[name=\'field2\']').html())); "

the input becomes:

<input type="text" value="d" onmouseover=alert(444); "" name="field" />