WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been writing some Wordpress plugins, and I've been having some problem with Wordpress putting magic quotes on POST and GET data.

Specifically, the "wp_magic_quotes" function in \wp-includes\load.php, which is called (presumably on every response) in wp-settings.php. This function adds magic quotes to the data even if I turn off magic quotes in PHP settings.

 * Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
 * Also forces $_REQUEST to be $_GET + $_POST. If $_SERVER, $_COOKIE,
 * or $_ENV are needed, use those superglobals directly.
 * @access private
 * @since 3.0.0
function wp_magic_quotes() {
    // If already slashed, strip.
    if ( get_magic_quotes_gpc() ) {
        $_GET    = stripslashes_deep( $_GET    );
        $_POST   = stripslashes_deep( $_POST   );
        $_COOKIE = stripslashes_deep( $_COOKIE );

    // Escape with wpdb.
    $_GET    = add_magic_quotes( $_GET    );
    $_POST   = add_magic_quotes( $_POST   );
    $_COOKIE = add_magic_quotes( $_COOKIE );
    $_SERVER = add_magic_quotes( $_SERVER );

    // Force REQUEST to be GET + POST.
    $_REQUEST = array_merge( $_GET, $_POST );

Is it safe for me to just comment out the wp_magic_quotes() call in wp-settings.php? That is, will it negatively affect the normal Wordpress code and/or open up some exploitation vector? If so, is there some other way to do it besides modifying WP code (so I don't have to deal with this every time there's an update)?

share|improve this question

migrated from stackoverflow.com Jul 1 '11 at 9:30

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted

Simply put WP turns indeterminate situation (magic quotes might or might not be enabled in server configuration) into determinate (magic quotes are always present and server configuration does not matter).

Rather than messing with this for all WP core it makes much more sense to simply strip slashes in your code on your own variables, when you need that.

share|improve this answer
This is insane, if I may. Magic quotes are considered bad by any sane coder, and this is a really irresponsible choice by Wordpress. Not that I'm surprised. – o0'. Oct 19 '14 at 10:11
@Lohoris note that WP doesn't just exist here and now. It exists ove span of many years. If magic quotes were inherently bad idea than they wouldn't exist in first place. While times change and it is easy to scream how bad idea it is now — changing the existing behavior in code base comes with massive security and backwards compatibility implications. – Rarst Oct 19 '14 at 10:19

The current behavior in WordPress is best practice based on the compatibility of all PHP systems and configurations. WordPress has always normalized $_GET, $_POST, $_COOKIE, and $_SERVER to be slashed, and expect that it will continue to do so.

So, to extract a POST or a GET parameter we have to write:

$value = stripslashes_deep($_POST['name']); or

$value = stripslashes_deep($_GET['name']);
share|improve this answer

I wrote a solution for dealing with these superglobal arrays in a similar question in Stack Overflow.

It consists of writing one single "accessor method" (get/set) for each superglobal, slashing and stripping transparently. So you'd use, for instance:

echo _get('username');    // echo stripslashes_deep($_GET['username']);
_cookie('name', 'value'); // $_COOKIE['name'] = addslashes_deep('value');

This way you can refrain from messing even further with the superglobals and enjoy a solution that will work "locally" for your code, without any side effects. For me, it was the ultimate solution.

share|improve this answer

I was recently having this problem and I finally figured it out. I was basically search almost every website on magic quotes on wordpress and none of them helped.

This is how to fix it:

1) go into your wp-settings.php

2) search for wp_magic_quotes();

3) just comment it out and it should work now

reason why this works

This works because if you look before that code you'll see:

// Disable magic quotes at runtime. Magic quotes are added using wpdb later in //wp-settings.php.

@ini_set( 'magic_quotes_runtime', 0 ); @ini_set( 'magic_quotes_sybase', 0 );

That Magic quotes that is added later on using wpdb is what is messing most people up and it happens to be wp_magic_quotes(). Just commenting that will prevent magic quotes from messing you up.

share|improve this answer
Bad idea: after the next upgrade this change is lost. – toscho Mar 31 '13 at 17:45
Altough this is a bad idea™, it is the only solution that I have found to run WordPress and Magento concurrently without giving Magento problems when saving content. – forsvunnet Feb 17 '15 at 9:25
This is also a bad idea because many plugins are badly written and don't escape SQL correctly so your site may become vulnerable to SQL injection attacks. And any plugins doing the correct thing by running stripslashes/stripslashes_deep on $_GET/$_POST will corrupt user input by removing backslashes. – holizz Feb 18 '15 at 13:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.