I've been writing some Wordpress plugins, and I've been having some problem with Wordpress putting magic quotes on POST and GET data.

Specifically, the "wp_magic_quotes" function in \wp-includes\load.php, which is called (presumably on every response) in wp-settings.php. This function adds magic quotes to the data even if I turn off magic quotes in PHP settings.

 * Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
 * Also forces $_REQUEST to be $_GET + $_POST. If $_SERVER, $_COOKIE,
 * or $_ENV are needed, use those superglobals directly.
 * @access private
 * @since 3.0.0
function wp_magic_quotes() {
    // If already slashed, strip.
    if ( get_magic_quotes_gpc() ) {
        $_GET    = stripslashes_deep( $_GET    );
        $_POST   = stripslashes_deep( $_POST   );
        $_COOKIE = stripslashes_deep( $_COOKIE );

    // Escape with wpdb.
    $_GET    = add_magic_quotes( $_GET    );
    $_POST   = add_magic_quotes( $_POST   );
    $_COOKIE = add_magic_quotes( $_COOKIE );
    $_SERVER = add_magic_quotes( $_SERVER );

    // Force REQUEST to be GET + POST.
    $_REQUEST = array_merge( $_GET, $_POST );

Is it safe for me to just comment out the wp_magic_quotes() call in wp-settings.php? That is, will it negatively affect the normal Wordpress code and/or open up some exploitation vector? If so, is there some other way to do it besides modifying WP code (so I don't have to deal with this every time there's an update)?

migrated from stackoverflow.com Jul 1 '11 at 9:30

This question came from our site for professional and enthusiast programmers.

  • Can anyone tell me, where/when the function wp_magic_quotes() is executed? I couldnt find the execution in wp-core. – T.Todua Feb 22 at 8:19
up vote 6 down vote accepted

Simply put WP turns indeterminate situation (magic quotes might or might not be enabled in server configuration) into determinate (magic quotes are always present and server configuration does not matter).

Rather than messing with this for all WP core it makes much more sense to simply strip slashes in your code on your own variables, when you need that.

  • 5
    This is insane, if I may. Magic quotes are considered bad by any sane coder, and this is a really irresponsible choice by Wordpress. Not that I'm surprised. – o0'. Oct 19 '14 at 10:11
  • 5
    @Lohoris note that WP doesn't just exist here and now. It exists ove span of many years. If magic quotes were inherently bad idea than they wouldn't exist in first place. While times change and it is easy to scream how bad idea it is now — changing the existing behavior in code base comes with massive security and backwards compatibility implications. – Rarst Oct 19 '14 at 10:19

The current behavior in WordPress is best practice based on the compatibility of all PHP systems and configurations. WordPress has always normalized $_GET, $_POST, $_COOKIE, and $_SERVER to be slashed, and expect that it will continue to do so.

So, to extract a POST or a GET parameter we have to write:

$value = stripslashes_deep($_POST['name']); or

$value = stripslashes_deep($_GET['name']);

I wrote a solution for dealing with these superglobal arrays in a similar question in Stack Overflow.

It consists of writing one single "accessor method" (get/set) for each superglobal, slashing and stripping transparently. So you'd use, for instance:

echo _get('username');    // echo stripslashes_deep($_GET['username']);
_cookie('name', 'value'); // $_COOKIE['name'] = addslashes_deep('value');

This way you can refrain from messing even further with the superglobals and enjoy a solution that will work "locally" for your code, without any side effects. For me, it was the ultimate solution.

I was recently having this problem and I finally figured it out. I was basically search almost every website on magic quotes on wordpress and none of them helped.

This is how to fix it:

1) go into your wp-settings.php

2) search for wp_magic_quotes();

3) just comment it out and it should work now

reason why this works

This works because if you look before that code you'll see:

// Disable magic quotes at runtime. Magic quotes are added using wpdb later in //wp-settings.php.

@ini_set( 'magic_quotes_runtime', 0 ); @ini_set( 'magic_quotes_sybase', 0 );

That Magic quotes that is added later on using wpdb is what is messing most people up and it happens to be wp_magic_quotes(). Just commenting that will prevent magic quotes from messing you up.

  • 6
    Bad idea: after the next upgrade this change is lost. – fuxia Mar 31 '13 at 17:45
  • Altough this is a bad idea™, it is the only solution that I have found to run WordPress and Magento concurrently without giving Magento problems when saving content. – forsvunnet Feb 17 '15 at 9:25
  • 1
    This is also a bad idea because many plugins are badly written and don't escape SQL correctly so your site may become vulnerable to SQL injection attacks. And any plugins doing the correct thing by running stripslashes/stripslashes_deep on $_GET/$_POST will corrupt user input by removing backslashes. – tomdxw Feb 18 '15 at 13:26

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.