// http://websec.github.io/unicode-security-guide/character-transformations/#handling
//
// Code point   First byte  Second byte Third byte  Fourth byte
// U+0000..U+007F   00..7F          
// U+0080..U+07FF   C2..DF  80..BF      
// U+0800..U+0FFF   E0  A0..BF  80..BF

$str = "\xC2\x22\x3C";
var_dump(
    "" === htmlspecialchars($str),
    false === preg_match('/./u', $str)
);