wppaste
WordPress

wp_xmlrpc_server::escape( string|array $data ): string|void

Since
1.5.2
Source
wp-includes/class-wp-xmlrpc-server.php:346

Slashes a string, or recursively slashes every string inside an array, using wp_slash() to prepare XML-RPC input for WordPress's database functions. It returns the slashed value for a plain string but modifies arrays in place by reference and returns nothing, silently skipping any objects it finds along the way. Because it only adds slashes rather than performing real SQL escaping, pair it with wpdb::prepare() or esc_sql() before building raw queries from the result.

Escapes string or array of strings for database.

Compatibility

WordPress
since 1.5.2
PHP
7.4–8.6-dev
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$datastring|array
Escape single string or array of strings.

Return value

string|void
Returns with string is passed, alters by-reference when array is passed.

Code examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

Escape a single string value from an XML-RPC request

Instantiate wp_xmlrpc_server directly to see how escape() slashes quotes in a plain string.

$server = new wp_xmlrpc_server();
$raw_title = 'A "quoted" post title with a don\'t-miss offer';
$escaped_title = $server->escape( $raw_title );

echo esc_html( $escaped_title );

The slashed value is meant for WordPress's database functions, not for direct display, wp_slash() adds backslashes that a template shouldn't echo unmodified.

Slash an array of XML-RPC parameters in place

Pass an array by reference so escape() walks every string recursively, including a nested array, while leaving objects untouched.

$server = new wp_xmlrpc_server();
$post_data = array(
    'post_title'   => 'Weekend Sale: 50% Off "Everything"',
    'custom_field' => array(
        'price' => 'Now only $9.99, was $19.99',
    ),
);

$server->escape( $post_data );

print_r( $post_data );

escape() returns nothing when given an array, the modification happens on $post_data itself because the parameter is passed by reference.

Common problems and fixes · 4

Why does wp_xmlrpc_server::escape() return null when I pass it an array?

The array branch of the method loops over the values and reassigns them by reference, it has no return statement, only the single-string branch returns wp_slash( $data ). Assigning the call to a variable when you pass an array captures nothing useful.

Why do my strings show backslashes before quotes after calling escape()?

escape() runs every string through wp_slash(), which adds the backslashes WordPress's database layer expects to strip on save. Echoing that value directly in a template or admin screen prints the raw backslashes.

Why doesn't escape() slash an object nested inside my data array?

The source explicitly checks elseif ( ! is_object( $v ) ), so any array element that is an object is skipped entirely and left unmodified.

Can I call wp_xmlrpc_server::escape() statically?

It is declared as a normal public instance method, not a static one, so it needs an object context. Calling it without an instance, or outside another wp_xmlrpc_server method where $this is available, fails.

Alternatives and related functions

wp_slash
When you just need to slash a single string or a plain array without the class instance this method requires.
wpdb::prepare
When you're building a raw SQL query and need placeholders and quoting handled together, rather than just adding slashes.
esc_sql
When you need to escape a value for direct inclusion in a SQL query outside of wpdb::prepare().
stripslashes_deep
When you need to reverse recursive slashing on an array that was previously escaped this way.

Performance profile

How much work a call to wp_xmlrpc_server::escape() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class
Light

Touches nothing outside its own arguments.

Scaling
Scales with input

The body loops, so the work grows with what you pass in.

Instructions
6–7

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 24.

Plugin surface
None

Nothing here hands control to plugin code.

Called by
50

50 places in core call this, so the cost is paid more often than your own code shows.

What one call costs · 2 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_xmlrpc_server::escape() can have, taken from its control-flow graph on PHP 8.5.

WhenInstructionsCalls it makes
is_array($data)6–7none
!is_array($data)7wp_slash()

Across PHP versions

Compiles the same on PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5 and 8.6-dev: 24 instructions, 6–7 executed per call, 5 branches. The work does not change between versions.

An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.

Uses · 2

Used by · 50

Show all 50

Source code

View on Trac View on GitHub 

	public function escape( &$data ) {		if ( ! is_array( $data ) ) {			return wp_slash( $data );		} 		foreach ( $data as &$v ) {			if ( is_array( $v ) ) {				$this->escape( $v );			} elseif ( ! is_object( $v ) ) {				$v = wp_slash( $v );			}		}	}

Changelog

Introduced in 1.5.2. One change between 6.7.7 and 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

7.1.0
Return type changed from string|void to string|null.verified against source
1.5.2
Introduced.from the docblock

About this page

Parsed data
Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/class-wp-xmlrpc-server.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.