stripcslashes
Removes backslashes and decodes C-style escape sequences in a string.
stripcslashes(string $string): string- Added in PHP 4.0
Parameters
| Parameter | Type | Description |
|---|---|---|
$string | string | The string to be unescaped. |
Return value
stringThe unescaped string.
stripcslashes() is the inverse of addcslashes(). It walks the string and converts C escape sequences into the bytes they represent: \n becomes a real newline, \t a real tab, \101 the octal-encoded byte A, and \x41 the hex-encoded byte A. A backslash in front of any other character is simply dropped.
When to reach for it
Use it to decode a value that was written in a C-like escaped form: a line pulled out of a generated config file, a single-quoted PHP or C literal captured as text, or a log entry that was flattened with addcslashes(). It is also a quick way to turn a user-supplied delimiter like the two characters \t into an actual tab when parsing CSV options from a command line.
What trips people up
It is not selective. Every backslash is consumed, whether or not it introduces a recognised escape, so \q becomes plain q and a Windows path such as C:\temp\new silently loses its backslashes and gains a tab and a newline. That makes it unsuitable for cleaning arbitrary input — it should only ever be pointed at data you know was escaped in this format in the first place.
Example
When to use it
- Decoding a value read from a generated config or log file that was written with addcslashes().
- Turning a command-line option written as the two characters \t into a real tab delimiter.
- Round-tripping binary payloads that were flattened to printable text for storage.
Frequently asked questions
What is the difference between stripcslashes and stripslashes?
stripslashes() only removes backslashes, undoing addslashes(). stripcslashes() also interprets C escape sequences, so \n becomes a real newline and \101 becomes the letter A.
Does stripcslashes handle hex and octal escapes?
Yes. It decodes octal sequences such as \101 and hexadecimal ones such as \x41, both producing the byte 0x41 (the character A).
Is it safe to run stripcslashes on user input?
No. It removes the backslash from every escape it does not recognise and rewrites sequences like \t and \n, so ordinary text and file paths get corrupted. Only apply it to data you escaped with addcslashes().
More examples
Round-tripping with addcslashes
The first var_dump is false: run directly on the path, stripcslashes() reads \t as a tab and \f as a form feed, mangling it. Escaping the backslashes first with addcslashes($original, '\\') doubles them, and only then does the round trip return the exact original string. This is why the backslash must always be in the addcslashes() character list.
<?php
$original = 'C:\path\to\file.txt';
var_dump(stripcslashes($original) === $original);
$escaped = addcslashes($original, '\\');
echo $escaped, "\n";
var_dump(stripcslashes($escaped) === $original);Unrecognised escapes lose their backslash
\q is not a C escape, so the backslash is simply removed and "aqb" is printed; the same happens to \%. A single trailing backslash with nothing after it is dropped entirely, leaving "trailing". None of these raise a warning, which is what makes stripcslashes() dangerous on data of unknown origin.
<?php
echo stripcslashes('a\qb'), "\n";
echo stripcslashes('50\% done'), "\n";
var_dump(stripcslashes('trailing\\'));Decoding a delimiter given as text
A command-line flag can only carry the two literal characters backslash and t. stripcslashes() converts them into the single tab byte, so explode() splits the line correctly. The var_dump shows the two-character input becoming a one-character delimiter.
<?php
$optionFromUser = '\t';
$delimiter = stripcslashes($optionFromUser);
$line = "id\tname\temail";
print_r(explode($delimiter, $line));
var_dump($delimiter === "\t", strlen($optionFromUser), strlen($delimiter));
Discussion