The addslashes() function returns a string with backslashes in front of predefined characters.
string addslashes ( string $str )
A use case of addslashes() is escaping the aforementioned characters in a string that is to be evaluated by PHP:
Prior to PHP 5.4.0, the PHP directive magic_quotes_gpc was on by default and it essentially ran addslashes() on all GET, POST and COOKIE data. addslashes() must not be used on strings that have already been escaped with magic_quotes_gpc, as the strings will be double escaped. get_magic_quotes_gpc() can be used to check if magic_quotes_gpc is on.
The addslashes() is sometimes incorrectly used to try to prevent SQL Injection. Instead, database-specific escaping functions and/or prepared statements should be used.
| Parameter | Description |
|---|---|
| str | The string to be escaped. |
Returns the escaped string.