If you check out the source for the
$wpdb->insert( $table, $data, $format) method you will find this comment:
Data to insert (in column => value pairs). Both $data columns and
$data values should be "raw" (neither should be SQL escaped).
so you shouldn't need to do the SQL escape yourself on the data.
As far as I understand the process, the data inserted into the
$wpdb->insert() method, goes through:
- which uses
- which uses
$wpdb->_real_escape(), for non floating values:
! is_float( $string ),
- that uses the PHP wrapper
mysqli_real_escape_string() for WP 3.9+ with PHP 5.5+.
From the PHP docs on the
Escapes special characters in the unescaped_string, taking into
account the current character set of the connection so that it is safe
to place it in a mysql_query(). If binary data is to be inserted, this
function must be used.
mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following
characters: \x00, \n, \r, \, ', " and \x1a.
This function must always (with few exceptions) be used to make data safe before sending a query to MySQL.
But as stated in the Codex page you refer to, in older versions of PHP the
addslashes can be automatically applied to the
$_REQUEST globals. The Magic Quotes feature is deprecated in PHP 5.3 and removed in 5.4.