wp_xmlrpc_server::escape( string|array $data ): string|null
- Since
- 1.5.2
- Source
wp-includes/class-wp-xmlrpc-server.php:361
Slashes a string, or every string inside an array, by delegating to wp_slash() so XML-RPC input matches what wp_insert_post() and similar functions expect. Arrays are walked recursively and modified by reference, so the call returns null in that case, while a plain string is returned directly. Objects found inside an array are skipped entirely, which surprises code that assumes every value comes back slashed.
Compatibility
- WordPress
- since 1.5.2
- PHP
- 7.4–8.6-dev
- 6.7.7
- 6.8.8
- 6.9.7
- 7.0.4
- 7.1.0
Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.
Parameters
$datastring|array- Escape single string or array of strings.
Return value
string|null- Returns with string if passed, alters by-reference when array is passed.
Code examples
Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.
Escape a single string before passing it to an XML-RPC handler
Custom XML-RPC methods often need to slash a raw client value the same way mw_editPost and friends do before it reaches wp_insert_post().
require_once ABSPATH . WPINC . '/class-wp-xmlrpc-server.php';
$server = new wp_xmlrpc_server();
$incoming_title = "O'Neill's Guide to WordPress";
$escaped_title = $server->escape( $incoming_title );
echo esc_html( $escaped_title );wp_xmlrpc_server is not loaded on a normal request, so it has to be required manually before it can be instantiated.
Escape an array of post meta values in place
When $data is an array, escape() rewrites each string element by reference instead of returning a new array.
require_once ABSPATH . WPINC . '/class-wp-xmlrpc-server.php';
$server = new wp_xmlrpc_server();
$fields = array(
'price' => get_post_meta( 2, 'price', true ),
'tagline' => 'Bob\'s "Deluxe" Widget, in stock now',
);
$return_value = $server->escape( $fields );
echo 'Return value: ' . var_export( $return_value, true ) . "\n";
echo '<pre>' . esc_html( print_r( $fields, true ) ) . '</pre>';$return_value is always null here; the escaped values have to be read back from $fields itself.
Common problems and fixes · 4
- Why did escape() return null instead of my escaped array?
- Why are the objects inside my array still unescaped?
- Does escape() protect my XML-RPC input from SQL injection?
- Why do I get a 'Class wp_xmlrpc_server not found' error when calling escape()?
Why did escape() return null instead of my escaped array?
Why are the objects inside my array still unescaped?
elseif ( ! is_object( $v ) ) before calling wp_slash(), so any element that is an object is left completely untouched, unlike nested arrays which are escaped recursively.Does escape() protect my XML-RPC input from SQL injection?
Why do I get a 'Class wp_xmlrpc_server not found' error when calling escape()?
Alternatives and related functions
wp_slash- When you only need to slash a single string or array without instantiating wp_xmlrpc_server, call wp_slash() directly.
wp_unslash- When you need to remove slashes from an already-escaped value before validating or comparing it.
wpdb::prepare- When you are building a raw SQL query, since escape() does not guard against SQL injection.
sanitize_text_field- When you need to sanitize user-submitted text for safe storage or display, not just add slashes.
Performance profile
How much work a call to wp_xmlrpc_server::escape() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.
- Cost class
- Light
- Scaling
- Scales with input
- Instructions
- 6–7
- Plugin surface
- None
- Called by
- 50
Touches nothing outside its own arguments.
The body loops, so the work grows with what you pass in.
Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 24.
Nothing here hands control to plugin code.
50 places in core call this, so the cost is paid more often than your own code shows.
What one call costs · 2 distinct outcomes
One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_xmlrpc_server::escape() can have, taken from its control-flow graph on PHP 8.5.
| When | Instructions | Calls it makes |
|---|---|---|
is_array($data) | 6–7 | none |
!is_array($data) | 7 | wp_slash() |
Across PHP versions
Compiles the same on PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5 and 8.6-dev: 24 instructions, 6–7 executed per call, 5 branches. The work does not change between versions.
An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.
Uses · 2
- wp_slash()Adds slashes to a string or recursively adds slashes to strings within an array.
- wp_xmlrpc_server::escape()Escapes string or array of strings for database.
Used by · 50
- wp_xmlrpc_server::blogger_deletePost()Deletes a post.
- wp_xmlrpc_server::blogger_editPost()Edits a post.
- wp_xmlrpc_server::blogger_getPost()Retrieves a post.
- wp_xmlrpc_server::blogger_getRecentPosts()Retrieves the list of recent posts.
- wp_xmlrpc_server::blogger_getUserInfo()Retrieves user's data.
- wp_xmlrpc_server::blogger_getUsersBlogs()Retrieves blogs that user owns.
- wp_xmlrpc_server::blogger_newPost()Creates a new post.
- wp_xmlrpc_server::escape()Escapes string or array of strings for database.
- wp_xmlrpc_server::mt_getCategoryList()Retrieves the list of all categories on a blog.
- wp_xmlrpc_server::mt_getPostCategories()Retrieves post categories.
- wp_xmlrpc_server::mt_getRecentPostTitles()Retrieves the post titles of recent posts.
- wp_xmlrpc_server::mt_publishPost()Sets a post's publish status to 'publish'.
Show all 50
- wp_xmlrpc_server::mt_setPostCategories()Sets categories for a post.
- wp_xmlrpc_server::mw_editPost()Edits a post.
- wp_xmlrpc_server::mw_getCategories()Retrieves the list of categories on a given blog.
- wp_xmlrpc_server::mw_getPost()Retrieves a post.
- wp_xmlrpc_server::mw_getRecentPosts()Retrieves list of recent posts.
- wp_xmlrpc_server::mw_newMediaObject()Uploads a file, following your settings.
- wp_xmlrpc_server::mw_newPost()Creates a new post.
- wp_xmlrpc_server::pingback_extensions_getPingbacks()Retrieves an array of URLs that pingbacked the given URL.
- wp_xmlrpc_server::pingback_ping()Retrieves a pingback and registers it.
- wp_xmlrpc_server::wp_deleteCategory()Deletes a category.
- wp_xmlrpc_server::wp_deleteComment()Deletes a comment.
- wp_xmlrpc_server::wp_deletePage()Deletes a page.
- wp_xmlrpc_server::wp_deletePost()Deletes a post for any registered post type.
- wp_xmlrpc_server::wp_deleteTerm()Deletes a term.
- wp_xmlrpc_server::wp_editComment()Edits a comment.
- wp_xmlrpc_server::wp_editPage()Edits a page.
- wp_xmlrpc_server::wp_editPost()Edits a post for any registered post type.
- wp_xmlrpc_server::wp_editProfile()Edits user's profile.
- wp_xmlrpc_server::wp_editTerm()Edits a term.
- wp_xmlrpc_server::wp_getAuthors()Retrieves authors list.
- wp_xmlrpc_server::wp_getComment()Retrieves a comment.
- wp_xmlrpc_server::wp_getCommentCount()Retrieves comment counts.
- wp_xmlrpc_server::wp_getCommentStatusList()Retrieves all of the comment status.
- wp_xmlrpc_server::wp_getComments()Retrieves comments.
- wp_xmlrpc_server::wp_getMediaItem()Retrieves a media item by ID.
- wp_xmlrpc_server::wp_getMediaLibrary()Retrieves a collection of media library items (or attachments).
- wp_xmlrpc_server::wp_getOptions()Retrieves blog options.
- wp_xmlrpc_server::wp_getPage()Retrieves a page.
- wp_xmlrpc_server::wp_getPageList()Retrieves page list.
- wp_xmlrpc_server::wp_getPageStatusList()Retrieves page statuses.
- wp_xmlrpc_server::wp_getPageTemplates()Retrieves page templates.
- wp_xmlrpc_server::wp_getPages()Retrieves Pages.
- wp_xmlrpc_server::wp_getPost()Retrieves a post.
- wp_xmlrpc_server::wp_getPostFormats()Retrieves a list of post formats used by the site.
- wp_xmlrpc_server::wp_getPostStatusList()Retrieves post statuses.
- wp_xmlrpc_server::wp_getPostType()Retrieves a post type.
- wp_xmlrpc_server::wp_getPostTypes()Retrieves post types.
- wp_xmlrpc_server::wp_getPosts()Retrieves posts.
Source code
public function escape( &$data ) { if ( ! is_array( $data ) ) { return wp_slash( $data ); } foreach ( $data as &$v ) { if ( is_array( $v ) ) { $this->escape( $v ); } elseif ( ! is_object( $v ) ) { $v = wp_slash( $v ); } } return null; }Changelog
Introduced in 1.5.2. One change between 6.7.7 and 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
string|void to string|null.verified against sourceAbout this page
- Parsed data
- Generated from the wordpress-develop 7.1.0 tag, from
src/wp-includes/class-wp-xmlrpc-server.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.