In the wp_kses codex page it says:

You have to remove any slashes from PHP's magic quotes before you call this function.

I am new(ish) to PHP and I wiki'd Magic Quotes and it was apparently recently deprecated/removed from the language. So is this something that I still have to worry about?

1 Answer 1


WordPress is still adding slashes to data sent per POST, so yes, in some cases you might have to remove the slashes. There are two options:

  1. Use stripslashes_deep( $value ). This function accepts an array, an object or a string and removes the slashes.
  2. Get POST data per:

    $data = file_get_contents( 'php://input' );

    This takes the data from the raw input stream, a resource that cannot be changed (read-only), so it is not changed by WordPress too. This doesn’t work when the form was sent with enctype="multipart/form-data", eg. with file uploads.

Be aware stripslashes_deep() might ruin JSON encoded strings.

Magic quotes are not quotes, they are backslashes \. They work like addslashes() and are applied on several places to incoming data. Backslashes are set before ', ", \ and the character NULL.

In WordPress there is a function add_magic_quotes() (wp-includes/functions.php). It runs on $_GET, $_POST, $_COOKIE and $_SERVER in wp-includes/load.php in the function wp_magic_quotes(), and on user/post data pulled from the database.

  • What exactly are PHP magic quotes? Do you have an example of when they might be added?
    – William
    Commented Jun 2, 2013 at 13:38
  • @William See my update.
    – fuxia
    Commented Jun 2, 2013 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.