PHP addslashes() And stripslashes(): String Escaping And Restoration

In PHP, addslashes() and stripslashes() are functions used to add and remove backslashes from a string, respectively. They're typically used to prepare data for storage in a database and retrieve it back.

1. addslashes():

The addslashes() function returns a string with backslashes before characters that need to be escaped. These characters are single quote ('), double quote ("), backslash (\), and NULL.

Here's an example of how to use it:

$str = "Hello, it's \"nice\" to meet you!";
$escapedStr = addslashes($str);

echo $escapedStr; 
// Outputs: Hello, it\'s \"nice\" to meet you!

In the above example, addslashes() adds a backslash before the single quote and the double quotes.

2. stripslashes():

The stripslashes() function returns a string with backslashes stripped off. It removes the backslashes added by addslashes().

Here's an example of how to use it:

$escapedStr = "Hello, it\'s \\\"nice\\\" to meet you!";
$originalStr = stripslashes($escapedStr);

echo $originalStr; 
// Outputs: Hello, it's "nice" to meet you!

In the above example, stripslashes() removes the backslashes that were added before the single quote and the double quotes.

These functions are useful when you're dealing with data that needs to be escaped before it's stored in a database. However, be aware that these functions are not sufficient to protect against SQL injection attacks. In most cases, you should use prepared statements or a database abstraction layer that automatically escapes data, rather than manually escaping data with addslashes().

Escape and unescape strings in PHP:

Escaping strings involves adding escape characters to special characters, while unescaping reverses the process.

// File: escape_unescape.php
$originalString = 'This is a "quoted" string';
$escapedString = addslashes($originalString);
$unescapedString = stripslashes($escapedString);

echo "Original: $originalString\nEscaped: $escapedString\nUnescaped: $unescapedString";
// Output: Original: This is a "quoted" string
//         Escaped: This is a \"quoted\" string
//         Unescaped: This is a "quoted" string

PHP addslashes() example code:

Use addslashes() to add backslashes before characters that need to be escaped, such as quotes.

// File: addslashes_example.php
$originalString = 'This is a "quoted" string';
$escapedString = addslashes($originalString);

echo "Original: $originalString\nEscaped: $escapedString";
// Output: Original: This is a "quoted" string
//         Escaped: This is a \"quoted\" string

Remove slashes from a string in PHP:

Use stripslashes() to remove backslashes added by escaping functions.

// File: remove_slashes.php
$escapedString = 'This is a \"quoted\" string';
$unescapedString = stripslashes($escapedString);

echo "Escaped: $escapedString\nUnescaped: $unescapedString";
// Output: Escaped: This is a \"quoted\" string
//         Unescaped: This is a "quoted" string

Secure string handling with addslashes() in PHP:

addslashes() can be used to secure string handling and prevent issues like SQL injection.

// File: secure_string_handling.php
$userInput = $_POST['username'];
$sanitizedInput = addslashes($userInput);

// Use $sanitizedInput in database queries

Using stripslashes() to clean user input in PHP:

Clean user input by removing backslashes added during the escaping process.

// File: clean_user_input.php
$userInput = $_POST['input'];
$cleanedInput = stripslashes($userInput);

// Use $cleanedInput in further processing

Preventing SQL injection with addslashes() in PHP:

Protect against SQL injection by using addslashes() on user input before including it in database queries.

// File: prevent_sql_injection.php
$userInput = $_POST['input'];
$sanitizedInput = addslashes($userInput);

// Use $sanitizedInput in database queries

Escaping quotes in PHP strings:

Use addslashes() to escape quotes within strings.

// File: escape_quotes.php
$quotedString = 'He said, "Hello!"';
$escapedString = addslashes($quotedString);

echo "Quoted: $quotedString\nEscaped: $escapedString";
// Output: Quoted: He said, "Hello!"
//         Escaped: He said, \"Hello!\"

PHP addslashes() vs htmlentities():

While addslashes() escapes quotes, htmlentities() converts special characters to HTML entities.

// File: addslashes_vs_htmlentities.php
$originalString = 'This is a "quoted" string';
$addslashesResult = addslashes($originalString);
$htmlentitiesResult = htmlentities($originalString);

echo "Original: $originalString\nAddslashes: $addslashesResult\nHtmlentities: $htmlentitiesResult";