stripslashes
Removes backslash escape characters from a string, undoing what addslashes added.
stripslashes(string $string): string- Added in PHP 4.0
Parameters
| Parameter | Type | Description |
|---|---|---|
$string | string | The escaped string to unescape. |
Return value
stringA string with backslashes removed; \\' becomes ', \\\\ becomes \\, and a backslash before any other character is dropped.
stripslashes removes one level of backslash escaping. A backslash followed by a quote, another backslash, or almost anything else is replaced by the character that followed it. Doubled backslashes collapse to one; a lone trailing backslash disappears.
When to reach for it
Its honest use is undoing an addslashes() you performed yourself — round-tripping a value through a legacy file format, a serialised blob, or a third-party API that escapes quotes on the way out. Occasionally you will meet a legacy database or export that stored escaped text and needs cleaning on read.
What trips people up
Most modern uses of this function are a mistake. Magic quotes were removed in PHP 5.4, so $_POST and $_GET are not escaped and calling stripslashes on them silently corrupts legitimate input containing backslashes — Windows paths, regex patterns, LaTeX. And addslashes/stripslashes are not a SQL escaping mechanism: use prepared statements with PDO or mysqli.
The function is also not recursive. On an array you must map it yourself, and on nested arrays you need a recursive walk.
Finally it is byte-based, so on encodings like Shift-JIS where 0x5C can be the second byte of a character, it will destroy valid text.
Example
When to use it
- Reverse an addslashes() call you made before writing a value to a legacy flat file
- Clean up escaped text read from an old database or export created before PHP 5.4
- Unescape quotes in a payload from a third-party API that escapes them on output
Frequently asked questions
Should I still call stripslashes on $_POST data?
No. Magic quotes were removed in PHP 5.4, so superglobals are never pre-escaped. Calling stripslashes on them strips backslashes that the user genuinely typed.
What is the difference between stripslashes and stripcslashes?
stripslashes removes simple backslash escaping as produced by addslashes. stripcslashes understands C-style sequences such as \n, \t, \x41 and octal codes, converting them into the characters they represent.
How do I use stripslashes on an array?
It only accepts a string, so use array_map('stripslashes', $array) for a flat array, or array_walk_recursive with a callback for nested arrays.
More examples
It is not recursive
array_map handles a flat array of strings, printing O'Brien and say "hi". A nested array needs the map applied at each level, or array_walk_recursive, because stripslashes itself only accepts a string.
<?php
$data = ['name' => "O\\'Brien", 'note' => "say \\\"hi\\\""];
print_r(array_map('stripslashes', $data));
$nested = ['user' => ['city' => "St\\'Ives"]];
print_r(array_map('stripslashes', $nested['user']));Damaging legitimate input
Both real values lose every backslash: the Windows path becomes unusable and the regex loses its escape sequences. This is exactly what happens when stripslashes is applied blindly to form input on modern PHP.
<?php
$path = 'C:\\Users\\ada\\notes.txt';
$regex = '\\d+\\s\\w+';
echo $path, "\n";
echo stripslashes($path), "\n"; // C:Usersadanotes.txt
echo stripslashes($regex), "\n"; // d+sw+Round-tripping a value
addslashes escapes the quotes and the backslash, and stripslashes restores the exact original string. The strict comparison proving true is the only situation in which reaching for stripslashes is clearly correct.
<?php
$original = 'He said "it\'s 50% off\\" today';
$stored = addslashes($original);
$restored = stripslashes($stored);
echo $stored, "\n";
var_dump($restored === $original); // bool(true)
Discussion