I've been writing some Wordpress plugins, and I've been having some problem with Wordpress putting magic quotes on POST and GET data.

Specifically, the "wp_magic_quotes" function in \wp-includes\load.php, which is called (presumably on every response) in wp-settings.php. This function adds magic quotes to the data even if I turn off magic quotes in PHP settings.

 * Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
 * Also forces $_REQUEST to be $_GET + $_POST. If $_SERVER, $_COOKIE,
 * or $_ENV are needed, use those superglobals directly.
 * @access private
 * @since 3.0.0
function wp_magic_quotes() {
    // If already slashed, strip.
    if ( get_magic_quotes_gpc() ) {
        $_GET    = stripslashes_deep( $_GET    );
        $_POST   = stripslashes_deep( $_POST   );
        $_COOKIE = stripslashes_deep( $_COOKIE );

    // Escape with wpdb.
    $_GET    = add_magic_quotes( $_GET    );
    $_POST   = add_magic_quotes( $_POST   );
    $_COOKIE = add_magic_quotes( $_COOKIE );
    $_SERVER = add_magic_quotes( $_SERVER );

    // Force REQUEST to be GET + POST.
    $_REQUEST = array_merge( $_GET, $_POST );

Is it safe for me to just comment out the wp_magic_quotes() call in wp-settings.php? That is, will it negatively affect the normal Wordpress code and/or open up some exploitation vector? If so, is there some other way to do it besides modifying WP code (so I don't have to deal with this every time there's an update)?


5 Answers 5


Simply put WP turns indeterminate situation (magic quotes might or might not be enabled in server configuration) into determinate (magic quotes are always present and server configuration does not matter).

Rather than messing with this for all WP core it makes much more sense to simply strip slashes in your code on your own variables, when you need that.

  • 8
    This is insane, if I may. Magic quotes are considered bad by any sane coder, and this is a really irresponsible choice by Wordpress. Not that I'm surprised.
    – o0'.
    Oct 19, 2014 at 10:11
  • 5
    @Lohoris note that WP doesn't just exist here and now. It exists ove span of many years. If magic quotes were inherently bad idea than they wouldn't exist in first place. While times change and it is easy to scream how bad idea it is now — changing the existing behavior in code base comes with massive security and backwards compatibility implications.
    – Rarst
    Oct 19, 2014 at 10:19

The current behavior in WordPress is best practice based on the compatibility of all PHP systems and configurations. WordPress has always normalized $_GET, $_POST, $_COOKIE, and $_SERVER to be slashed, and expect that it will continue to do so.

So, to extract a POST or a GET parameter we have to write:

$value = stripslashes_deep($_POST['name']); or

$value = stripslashes_deep($_GET['name']);

I wrote a solution for dealing with these superglobal arrays in a similar question in Stack Overflow.

It consists of writing one single "accessor method" (get/set) for each superglobal, slashing and stripping transparently. So you'd use, for instance:

echo _get('username');    // echo stripslashes_deep($_GET['username']);
_cookie('name', 'value'); // $_COOKIE['name'] = addslashes_deep('value');

This way you can refrain from messing even further with the superglobals and enjoy a solution that will work "locally" for your code, without any side effects. For me, it was the ultimate solution.


I recently had this problem, and I finally figured it out. I was basically searching almost every website on magic quotes on WordPress and none of them helped.

This is how to fix it:

  1. Go into your wp-settings.php

  2. Search for wp_magic_quotes();

  3. Just comment it out and it should work now

This works because if you look before that code you'll see:

// Disable magic quotes at runtime. Magic quotes are added using wpdb later in //wp-settings.php.

@ini_set( 'magic_quotes_runtime', 0 );
@ini_set( 'magic_quotes_sybase',  0 );

That Magic quotes that is added later on using wpdb is what is messing most people up, and it happens to be wp_magic_quotes(). Just commenting that out will prevent magic quotes from messing you up.

  • 6
    Bad idea: after the next upgrade this change is lost.
    – fuxia
    Mar 31, 2013 at 17:45
  • Altough this is a bad idea™, it is the only solution that I have found to run WordPress and Magento concurrently without giving Magento problems when saving content.
    – forsvunnet
    Feb 17, 2015 at 9:25
  • 1
    This is also a bad idea because many plugins are badly written and don't escape SQL correctly so your site may become vulnerable to SQL injection attacks. And any plugins doing the correct thing by running stripslashes/stripslashes_deep on $_GET/$_POST will corrupt user input by removing backslashes.
    – user202
    Feb 18, 2015 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.