Just FYI I wouldn't consider using stripcslashes as it could also cause XSS.
Let me explain:
stripslashes vs stripcslashes
stripslashes removes all backslashes regardless of type
stripcslashes will remove all backslashes except hex characters, so what this means is that you could perform an XSS attack on a function that uses stripcslashes by doing something like this:
Which when evaluated by the stripcslashes function will result in : alert('XSS!');
This was actually a vulnerability I found within a popular Wordpress plugin (Platinum SEO <= 1.3.7)
Just make sure you do your research on the functions you are using before you use them as you could be causing more issues than it's worth.
This also applies to your usage of addcslashes() as you could force it to evaluate code where you don't want it to, like so:
$>php -r 'echo addcslashes("\x41", "A..z");'
And here is a basic example of that in use for a malformed XSS string:
> php -r 'echo addcslashes("\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x27\x58\x53\x53\x21\x27\x29\x3b\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e", "/");'
As you can see, that would still execute the alert.
As mehaase confirmed, there is no possible way of invoking PHP code without using something like include(), require(), eval(), system() (You've got more worries if you are using system() on user input than PHP Arbitrary code execution).