stripslashes()

Purpose

stripslashes() un-quotes a string that has had backslashes added in front of special characters. It walks through the input and removes each backslash that acts as an escape marker, keeping the character that follows it. A quoted O\'reilly becomes O'reilly, and a doubled backslash becomes one backslash.

It is the rough inverse of addslashes(). You would reach for it when text arrives in a backslash-quoted form and you only need to display or process the plain text, not insert it into a place that needs escaping, such as a database query.

Signature

Parameters and defaults

There are no optional parameters. The function works on bytes, so it does not depend on locale or character encoding.

Return value and failure cases

The function always returns a string: the input with backslash quoting removed. It does not return false and does not emit warnings for odd input such as an empty string or a trailing backslash.

Because the parameter is typed string, passing an array raises a TypeError. Passing null to a non-nullable internal parameter is deprecated since PHP 8.1, so convert or check values first rather than relying on implicit coercion.

Example 1: Un-quoting an apostrophe

The simplest case is a backslash before a single quote. In the double-quoted literal below, \\ produces one real backslash in the string, so the value being processed is Is your name O\'reilly?.

<?php
$quoted = "Is your name O\\'reilly?";
echo stripslashes($quoted), "\n";

Is your name O'reilly?

The backslash is dropped and the apostrophe stays.

Example 2: Doubled backslashes

A pair of backslashes represents one literal backslash. stripslashes() collapses each pair into a single backslash, which is useful to see with Windows-style paths that were quoted.

<?php
$escaped = "C:\\\\temp\\\\new";
echo $escaped, "\n";
echo stripslashes($escaped), "\n";

C:\\temp\\new
C:\temp\new

The first line shows the quoted form with doubled backslashes; the second shows the result with single ones. No string is evaluated as a path here; this is purely text processing.

Example 3: Arrays need recursion

stripslashes() accepts only a string, so it is not recursive and does not process arrays. To clean nested data, write a small helper that calls itself for array elements.

<?php
function stripslashes_deep(array|string $value): array|string
{
    if (is_array($value)) {
        return array_map('stripslashes_deep', $value);
    }

    return stripslashes($value);
}

$data = ["f\\'oo", ["fo\\'o", "b\\'ar"]];
echo json_encode(stripslashes_deep($data), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), "\n";

["f'oo",["fo'o","b'ar"]]

The helper keeps the array structure and un-quotes every string leaf. Non-string leaves such as integers would trigger type coercion, so validate your data shape if it can contain them.

Edge cases

• Backslash followed by any character: the backslash is removed and the next character is kept, even if it was never special. \a becomes a.
• Trailing backslash: a single backslash at the very end of the string is removed.
• Backslash then zero: the two-character sequence \0 becomes a real NUL byte, not the digit zero. Binary-unsafe code downstream may then truncate the text.
• Empty string: returns an empty string.
• No backslashes: the string is returned unchanged.
• Not idempotent for doubled backslashes: running it twice on \\\\ first yields \\, then removes that last backslash too. Apply it exactly as many times as the data was quoted.

Common mistakes

1. Treating it as a security filter. Removing backslashes does not make text safe for HTML, SQL or shell use. Use output escaping such as htmlspecialchars() for HTML and prepared statements for databases.
2. Applying it to data that was never quoted. Legitimate backslashes, such as those in file paths, regular expressions or JSON text, are damaged.
3. Calling it twice. A second call can remove backslashes that were genuinely part of the content.
4. Passing arrays. This throws a TypeError; use a recursive helper as shown above.
5. Confusing it with addslashes(). The two are opposites, and neither is a complete escaping strategy.
6. Forgetting PHP literal rules. In source code, the literal "\\'" already contains a backslash, while "\'" in double quotes keeps both characters. Test with the real string values, not with what you think the literal means.

Related functions

• addslashes() adds backslashes before quotes, backslashes and NUL.
• stripcslashes() un-quotes C-style escape sequences such as \n.
• htmlspecialchars() escapes text for HTML output.
• array_map() applies a callback across arrays, as used in the recursive helper.

Recap

stripslashes(string $string): string removes backslash quoting, turning \' into ' and \\ into \. It is non-recursive, never returns false, and is not a safety tool. Use it only on data you know was backslash-quoted, apply it once, and handle arrays yourself.