stripcslashes()

Purpose

stripcslashes() decodes a string that contains C-style backslash escapes. It is the counterpart of addcslashes(). Sequences such as \n, \t, \x41 and \101 are replaced with the characters they stand for. Use it when text has been stored or transmitted in an escaped form and you need the raw characters back.

The key point is that the input holds literal backslash characters. In a single-quoted PHP string, 'a\nb' is four characters: a, a backslash, n and b. After stripcslashes() it becomes three characters: a, a real newline and b.

Signature

Parameters and defaults

• $string: the string to unescape. It is required and has no default.

There are no flags or optional arguments. The function always applies the same rules.

What gets decoded

The manual says the function recognizes C-like escapes such as \n and \r, plus octal and hexadecimal representations. In practice:

• Named escapes such as \n, \t, \r, \a, \v, \b and \f become the matching control characters.
• \x followed by hex digits becomes the byte with that value, for example \x41 becomes A.
• A backslash followed by octal digits becomes the byte with that value, for example \101 becomes A. Up to three octal digits are read.
• A backslash before any other character is dropped, and the character itself stays. For example \" becomes " and \\ becomes a single backslash.

Return value and failure cases

The function returns the unescaped string. It does not return false and does not throw for malformed escapes. It is lenient instead. For instance, a backslash at the very end of the input has nothing to escape, so it stays in the result. Because the parameter is typed string, passing an array or an object without __toString() raises a TypeError. Other scalar values follow the usual PHP coercion rules for the current strict_types setting.

Example 1: named escapes

This input uses single quotes, so the backslashes are literal characters that stripcslashes() can interpret. The result is encoded with JSON so the control characters are visible.

<?php
$escaped = 'Line one\nLine two\tTabbed';
$plain = stripcslashes($escaped);
echo json_encode($plain, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), "\n";

"Line one\nLine two\tTabbed"

The JSON output shows \n and \t because the decoded string now contains a real newline and a real tab.

Example 2: hex, octal and quotes

Numeric escapes are useful when data was escaped by character code. The same call also removes the backslash before a quote.

<?php
$escaped = 'Hex: \x41\x42, octal: \101\102, quote: \"ok\"';
echo json_encode(stripcslashes($escaped), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), "\n";

"Hex: AB, octal: AB, quote: \"ok\""

Both \x41\x42 and \101\102 decode to AB.

Example 3: round trip with addcslashes()

The function is designed to reverse addcslashes(). The character list "\0..\37" selects all ASCII control characters, so tab and newline are written in their escaped forms.

<?php
$original = "Tab\tand newline\nand done";
$escaped = addcslashes($original, "\0..\37");
$restored = stripcslashes($escaped);
echo json_encode(['escaped' => $escaped, 'restored' => $restored, 'same' => $restored === $original], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), "\n";

{"escaped":"Tab\\tand newline\\nand done","restored":"Tab\tand newline\nand done","same":true}

The escaped value contains visible backslashes, shown doubled in JSON. The restored value matches the original exactly.

Edge cases

• Unknown escapes lose the backslash. \q becomes q. The function does not keep unrecognized sequences.
• Trailing backslash. A single backslash at the end of the string is kept as it is.
• Octal beats literal digits. In \1012, the first three digits are read as octal (A), and 2 remains a normal character.
• Hex needs digits. \x without a following hex digit is not a hex escape, so the result is just the letter x.
• Bytes, not characters. Numeric escapes produce single bytes. Values above 127 may form invalid UTF-8 unless the bytes together make a valid sequence.
• Not a security filter. Decoding escapes can create quotes, newlines or NUL bytes. Never treat the output as safe for SQL, HTML or shell use without proper context-specific escaping.

Common mistakes

1. Confusing it with stripslashes(). stripslashes() only removes backslashes, so \n becomes the letter n. stripcslashes() converts it to a newline.
2. Testing with double-quoted literals. In "a\nb", PHP already turns \n into a newline before the function runs. Use single quotes or \\n when you want literal backslashes.
3. Expecting an exact inverse of every escaper. It reverses addcslashes() output. It does not undo addslashes(), json_encode(), URL encoding or HTML entities.
4. Decoding twice. A second pass can remove backslashes that were meant to stay, for example turning \\n into n after the first pass produced \n.
5. Assuming validation. Malformed escapes are silently accepted, so use a stricter parser if you must reject bad input.

Related functions

• addcslashes() escapes selected characters in C style and is the main partner of this function.
• stripslashes() removes backslashes without interpreting C escapes.
• addslashes() escapes quotes, backslashes and NUL for simple quoting cases.
• json_decode() is the right tool for JSON string escapes.
• hex2bin() and bin2hex() handle whole-string hexadecimal conversion.

Recap

stripcslashes(string $string): string converts C-style escapes, octal codes and hex codes in a string into the raw characters they represent. Any other backslash-prefixed character loses its backslash. It is lenient, never returns false for bad escapes, and works on bytes. Use it to reverse addcslashes(), and remember that decoded output still needs context-appropriate escaping before it goes into SQL, HTML or a shell command.