I've been reading the codex at this page: http://codex.wordpress.org/Function_Reference/stripslashes_deep

The code i wrote before reading that page is this:

$data   = array(
    'col1' => $v['float'],
    'col2' => stripslashes($v['string'])
$format = array( '%f', '%s' );
$wpdb->insert( 'table', $data, $format );

Basically i manually pass stripslashed values in the $data array. Now, is this code correct and secure or shall i perform a $_REQUEST = array_map( 'stripslashes_deep', $_REQUEST );? Is there any important difference or is it the same?


If you check out the source for the $wpdb->insert( $table, $data, $format) method you will find this comment:

Data to insert (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped).

so you shouldn't need to do the SQL escape yourself on the data.

As far as I understand the process, the data inserted into the $wpdb->insert() method, goes through:

  • the $wpdb->prepare() method,
  • which uses $wpdb->escape_by_ref(),
  • which uses $wpdb->_real_escape(), for non floating values: ! is_float( $string ),
  • that uses the PHP wrapper mysql_real_escape_string() or mysqli_real_escape_string() for WP 3.9+ with PHP 5.5+.

From the PHP docs on the mysql_real_escape_string() function:

Escapes special characters in the unescaped_string, taking into account the current character set of the connection so that it is safe to place it in a mysql_query(). If binary data is to be inserted, this function must be used. mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a. This function must always (with few exceptions) be used to make data safe before sending a query to MySQL.

But as stated in the Codex page you refer to, in older versions of PHP the addslashes can be automatically applied to the $_POST, $_GET and $_REQUEST globals. The Magic Quotes feature is deprecated in PHP 5.3 and removed in 5.4.

  • 1
    so, at the end, what should i do? what's the correct and safe way to pass a string to wpdb->insert? if i don't stripslash the string, i don't think i will be able to preserve an eventual new line in a textarea...right? – Mariano Mar 29 '14 at 12:08
  • This should take care of SQL injections, but you still have to do the validation/sanitazion. I think new lines will be preserved. If you want to allow HTML input, consider using wp_kses() to strip out evil scripts. – birgire Mar 29 '14 at 12:36
  • no html, only \n new lines...so i don't have to worry about evil scripts... – Mariano Mar 29 '14 at 12:41
  • I'm not sure you want to strip out all HTML or just encode it. If you want to strip HTML and only allow alphanumerics and white spaces (including new lines): echo preg_replace( '/[^a-zA-Z0-9\s]/i', '', wp_strip_all_tags( $text, FALSE ) ); but this might be too restrict for you ? There also exsits the WordPress functions esc_html() to escape HTML blocks and esc_textarea() to escape the textarea content. – birgire Mar 29 '14 at 14:12
  • To strip out any % encoded octets: $text = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $text ); I'm not sure this exists as a special function, but it's included in some WordPress functions. – birgire Mar 29 '14 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.