addslashes()

Purpose

addslashes() returns a copy of a string in which a small, fixed set of characters is preceded by a backslash. The characters are the single quote ('), the double quote ("), the backslash (\) and the NUL byte. It is a plain byte-level transformation, so it is useful when you need to embed text inside a quoted string literal that another piece of PHP code will read. It is not a general security tool.

Signature

Parameters and defaults

• $string: the text to escape. It is required and has no default value.

There are no optional parameters and no flags. You cannot choose which characters are escaped; the list is fixed. If you need a custom list or a range of characters, look at addcslashes() instead.

Return value and failure cases

The function always returns a string. Characters outside the four listed ones pass through unchanged, so a string with nothing to escape comes back identical. The function does not return false and does not emit warnings for ordinary strings.

A type error is the only realistic failure. Passing an array, for example, throws a TypeError. Without declare(strict_types=1), scalar values such as integers are converted to strings first.

Example 1: the basic case

The apostrophe in the name receives a backslash. Nothing else in the sentence changes.

<?php
$text = "Is your name O'Reilly?";
echo addslashes($text), "\n";

Is your name O\'Reilly?

Example 2: all four characters

This example escapes every character the function handles. The result is printed through json_encode() so the output is unambiguous, and the lengths show that each of the four special characters gained exactly one extra byte. The NUL byte becomes a backslash followed by the digit zero, so the escaped text is printable.

<?php
$input = "A'B\"C\\D\0E";
$escaped = addslashes($input);
echo json_encode($escaped, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), "\n";
echo strlen($input), " ", strlen($escaped), "\n";

"A\\'B\\\"C\\\\D\\0E"
9 13

The JSON output doubles each backslash and escapes the double quote, which is why it looks busier than the original text.

Example 3: reversing the escape

stripslashes() undoes the transformation, so a round trip returns the original text.

<?php
$original = "It's \"quoted\" and C:\\temp";
$escaped = addslashes($original);
$restored = stripslashes($escaped);
echo $escaped, "\n";
echo $restored, "\n";
var_dump($restored === $original);

It\'s \"quoted\" and C:\\temp
It's "quoted" and C:\temp
bool(true)

Edge cases

• Backslashes are escaped too. An existing backslash becomes two backslashes. Calling addslashes() twice on the same value therefore escapes the first pass's backslashes again, producing text that no longer matches what you intended.
• Other control characters are untouched. Newlines, tabs and carriage returns are not changed. Only the NUL byte is converted among control characters.
• Multibyte text is not interpreted. The function works on bytes and does not know about character sets. Non-ASCII text without the four special bytes is returned as it was.
• An empty string returns an empty string.

Common mistakes

1. Using it to prevent SQL injection. The manual specifically warns that this is an incorrect use. Quoting rules differ between database systems and connection settings, so a generic function cannot be trusted for this job. Use prepared statements or the escaping function that belongs to your database driver.
2. Using it for HTML output. Backslashes do nothing to protect a web page. Use htmlspecialchars() when printing user text into HTML.
3. Escaping repeatedly. Apply the function once, at the point where the escaped form is needed, and keep the raw value elsewhere in your program.
4. Assuming the result is safe for any language. The escape rules match PHP-style quoting only loosely. For JSON, use json_encode(); for shell commands or regular expressions, use the escaping tools designed for them.
5. Forgetting to undo it. If you store an escaped string and later display it, users will see stray backslashes unless you call stripslashes() or avoid escaping in the first place.

Related functions

• stripslashes() removes the backslashes that quoting added.
• addcslashes() escapes a character list you choose, using C-style rules.
• stripcslashes() reverses addcslashes().
• htmlspecialchars() converts characters that are special in HTML into entities.
• quotemeta() escapes a different set of meta characters.

Recap

addslashes() takes one string and returns it with a backslash placed before ', ", \ and NUL. It never changes other characters and does not fail on strings. Use it only when you really need that exact escaping, and rely on prepared statements, HTML escaping or json_encode() for security-sensitive output.