addslashes
Escapes single quotes, double quotes, backslashes and NUL bytes in a string with backslashes.
addslashes(string $string): string- Added in PHP 4.0
Parameters
| Parameter | Type | Description |
|---|---|---|
$string | string | The string to escape. |
Return value
stringThe input string with a backslash inserted before every single quote, double quote, backslash and NUL byte.
addslashes walks a string and puts a backslash in front of exactly four things: ', ", \ and the NUL byte (which becomes the two characters \0). Nothing else is touched.
When to reach for it
Use it when you are generating a quoted literal for a format whose escape rules really are backslash-before-quote: a PHP or C source snippet you are writing to disk, a small config file, or a legacy template language. stripslashes reverses it exactly.
What trips people up
It is still widely copy-pasted as SQL protection. It is not. It does not know your database's charset, it does not escape %, _, backticks or comment markers, and on some multi-byte encodings the escaping can be walked past entirely. Use prepared statements, or mysqli_real_escape_string/PDO::quote if you must build SQL by hand.
It is also not HTML escaping. Putting addslashes output into a web page leaves <script> intact — that is htmlspecialchars's job.
Finally, the old magic_quotes_gpc setting is long gone, so request data arrives unescaped. Calling addslashes "just in case" on $_POST and then storing it means literal backslashes in your database.
Example
When to use it
- Escape a value before writing it into a generated PHP or JSON-ish config file as a quoted literal.
- Round-trip a string through a legacy template that expects backslash-escaped quotes, reversing it with stripslashes.
- Escape user text before embedding it in a regex replacement or single-quoted literal you are code-generating.
Frequently asked questions
Is addslashes safe against SQL injection?
No. It escapes only quotes, backslashes and NUL, with no knowledge of your database or its charset, so injection through wildcards, comment syntax or multi-byte encodings still works. Use prepared statements with bound parameters.
What is the difference between addslashes and htmlspecialchars?
addslashes escapes quotes and backslashes for string literals; htmlspecialchars converts &, <, >, " and ' into HTML entities so text is safe inside a web page. They protect against completely different things and are not interchangeable.
How do I undo addslashes?
Call stripslashes on the result — it removes one level of backslash escaping and is an exact inverse. For addcslashes output use stripcslashes instead.
More examples
NUL bytes become two characters
The raw string is 3 bytes. After escaping it is 4, because the NUL byte is replaced by the two visible characters backslash and zero. var_dump shows string(4) "a\0b" — this is the one case where addslashes changes the byte count by more than a quote count would suggest.
<?php
$raw = "a" . chr(0) . "b";
echo strlen($raw), "\n";
$escaped = addslashes($raw);
echo strlen($escaped), "\n";
var_dump($escaped);What addslashes does NOT escape
The first string comes back byte-for-byte identical: SQL wildcards, underscores, backticks and comment markers are all left alone. The HTML is unchanged too. This is why addslashes protects neither a query nor a web page.
<?php
$search = "50% off_deal `x` -- comment";
echo addslashes($search), "\n";
var_dump(addslashes($search) === $search);
$html = "<script>alert(1)</script>";
echo addslashes($html), "\n";Building a quoted literal safely
Each value is wrapped in single quotes with its own quotes and backslashes escaped, so the result is a valid single-quoted literal. The final check confirms stripslashes is an exact inverse for any input.
<?php
$values = ["plain", "it's", 'say "hi"', 'back\\slash'];
foreach ($values as $v) {
echo "'" . addslashes($v) . "'\n";
}
var_dump(stripslashes(addslashes('mix "of" \'both\'')) === 'mix "of" \'both\'');
Discussion