wppaste
WordPress

wp_slash( string|array $value ): string|array

Since
3.6.0, 5.5.0
Source
wp-includes/formatting.php:5864

Escapes a string, or every string nested inside an array, using addslashes() so the value matches the slashed format WordPress core APIs expect. It mirrors the legacy magic-quotes style escaping WordPress still applies to $_POST and $_GET, which is why functions like wp_insert_post() call wp_unslash() internally before using the data. It is not a SQL-safe escape, so quoting for a database query still needs $wpdb->prepare() or esc_sql().

Adds slashes to a string or recursively adds slashes to strings within an array.

Description

This should be used when preparing data for core API that expects slashed data.
This should not be used to escape data going directly into an SQL query.

Compatibility

WordPress
since 5.5.0
PHP
7.4–8.6-dev
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$valuestring|array
String or array of data to slash.

Return value

string|array
Slashed $value, in the same type as supplied.

Code examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

Slash a post title before passing it to wp_update_post

wp_update_post() runs wp_unslash() on the array you give it, so a title containing quotes needs to be slashed first or the quotes can be mangled.

$post_id      = 2;
$new_title    = 'Editor\'s "top picks" for the week';
$slashed_title = wp_slash( $new_title );

wp_update_post(
	array(
		'ID'         => $post_id,
		'post_title' => $slashed_title,
	)
);

$updated = get_post( $post_id );
echo esc_html( $updated->post_title );

get_post() returns the unslashed value for display, so the echoed title shows the original quotes and apostrophe intact.

Slash an entire post array before wp_insert_post

wp_slash() walks every element of an array, which is handy when several fields in a new post array contain quotes.

$postarr = array(
	'post_title'   => 'Reader\'s Q&A: "What is caching?"',
	'post_content' => 'A short answer covering the "basics" of caching.',
	'post_status'  => 'draft',
);

$slashed_postarr = wp_slash( $postarr );
$post_id = wp_insert_post( $slashed_postarr );

$post = get_post( $post_id );
echo esc_html( $post->post_title ) . '<br>';
echo esc_html( $post->post_content );

Common problems and fixes · 3

Why do apostrophes turn into double backslashes after I save a post?

This happens when data that already went through WordPress's own slashing of $_POST or $_GET gets passed to wp_slash() a second time. The function has no way to detect that a string is already escaped; it just runs addslashes() again.

Can I use wp_slash to make a value safe for a SQL query?

No. The source only wraps addslashes(), which is not charset-aware and does not match how $wpdb quotes values. The docblock explicitly warns against using it for SQL.

Why does wp_slash leave my integers or booleans unchanged?

The function checks is_array() then is_string() and only transforms those two cases; anything else falls through to the final return $value line and comes back exactly as it was passed in.

Alternatives and related functions

wp_unslash
When you need to reverse the effect and strip the slashes back off before displaying or comparing a value.
wp_slash_strings_only
When the input is already known to be a plain string or a flat array and you don't want array_map recursing into nested structures.
wpdb::prepare
When the value is going into a raw SQL query rather than into a core API that expects slashed data.
stripslashes_deep
When you're cleaning up a whole array or object that came from a source (like superglobals) already slashed by WordPress.

Performance profile

How much work a call to wp_slash() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class
Trivial

Touches nothing outside its own arguments.

Scaling
Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions
6–9

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 15.

Plugin surface
None

Nothing here hands control to plugin code.

Called by
50

50 places in core call this, so the cost is paid more often than your own code shows.

What one call costs · 3 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_slash() can have, taken from its control-flow graph on PHP 8.5.

WhenInstructionsCalls it makes
!is_array($value) && !is_string($value)6none
is_array($value)8array_map()
!is_array($value) && is_string($value)9addslashes()

Across PHP versions

Compiles the same on PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5 and 8.6-dev: 15 instructions, 6–9 executed per call, 2 branches. The work does not change between versions.

An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.

Used by · 50

Show all 50

Source code

View on Trac View on GitHub 

function wp_slash( $value ) {	if ( is_array( $value ) ) {		return array_map( 'wp_slash', $value );	} 	if ( is_string( $value ) ) {		return addslashes( $value );	} 	return $value;}

Changelog

Introduced in 3.6.0. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

5.5.0
Non-string values are left untouched.from the docblock
3.6.0
Introduced.from the docblock

About this page

Parsed data
Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.