$wpdb->update or $wpdb->insert results in slashes

问题:

This question has been posed a few times in various places, but I haven't found a definative and clear answer. Most solutions involve people saying to disable Magic Quotes on the php.ini file (which I did) or modifying core WP files.

Anyways, the question is this: why is it everytime I use $wpdb->insert or $wpdb->update a slash gets added before any single quote. So for instance:

I've eaten strawberries becomes I\'ve eaten strawberries

Here's a sample code I used:

$id = $_POST['id'];
$title = $_POST['title'];
$message = $_POST['message'];

$wpdb->update('table_name', array('id'=>$id, 'title'=>$title, 'message'=>$message), array('id'=>$id))

The same problem was here: Wordpress Database Output - Remove SQL Injection Escapes but it was never solved aside from "disable magic quotes"

回答1:

After spending the day on this, the answer is as follows:

Wordpress escapes at the $_POST declaration, not at the actual insert, which is bizarre.

$id = stripslashes_deep($_POST['id']); //added stripslashes_deep which removes WP escaping.
$title = stripslashes_deep($_POST['title']);
$message = stripslashes_deep($_POST['message']);

$wpdb->update('table_name', array('id'=>$id, 'title'=>$title, 'message'=>$message), array('id'=>$id));

Doing this will mean that WP will not add slashes before any quotes.

回答2:

a little more info--WordPress decided to make people think they were going crazy by adding 'magic quotes' even if you've got it turned off starting in version 3.0. Any access to $_REQUEST, $_GET, $_POST, $_COOKIE, or $_SERVER will be affected. See wp-includes/load.php.

 /* Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
 * @since 3.0.0
 */
function wp_magic_quotes() {
        // If already slashed, strip.
        if ( get_magic_quotes_gpc() ) {
                $_GET    = stripslashes_deep( $_GET    );
                $_POST   = stripslashes_deep( $_POST   );
                $_COOKIE = stripslashes_deep( $_COOKIE );
        }

        // Escape with wpdb.
        $_GET    = add_magic_quotes( $_GET    );
        $_POST   = add_magic_quotes( $_POST   );
        $_COOKIE = add_magic_quotes( $_COOKIE );
        $_SERVER = add_magic_quotes( $_SERVER );

        // Force REQUEST to be GET + POST.
        $_REQUEST = array_merge( $_GET, $_POST );
}

回答3:

WordPress ignores the built in php magic quotes setting and the value of get_magic_quotes_gpc() and will always add magic quotes (even after the feature is removed from PHP in 5.4).

you can use this instead

//replace $_POST with $POST
$POST      = array_map( 'stripslashes_deep', $_POST);
$wpdb->insert( 
        'wp_mytable', 
        array( 
            'field_name'        => $POST['field_name'], 
            'type'              => $POST['type'],
            'values'            => serialize($POST['values']),
            'unanswered_link'   => $POST['unanswered_link'], 
        ), 
        array( 
            '%s','%s','%s','%s'
        ) 
    );

WordPress does this because too much core and plugin code has come to rely on the quotes being there, so disabling quotes on the super globals (as is done in both the "Basic Example" and "Good Coding Practice" examples above) is likely to cause security holes.

http://codex.wordpress.org/Function_Reference/stripslashes_deep