Post Meta Adding Slashes

[cpoteet]

The custom fields function in version 2.05 adds a slash before apostrophes and quotations for the SQL insert.

$value = maybe_serialize($value);
$value = $wpdb->escape($value);
$value = stripslashes($value); // Added to remove slashes before insert

[cpoteet]

Replying to cpoteet:

The custom fields function in version 2.05 adds a slash before apostrophes and quotations for the SQL insert.

$value = maybe_serialize($value);
$value = $wpdb->escape($value);
$value = stripslashes($value); // Added to remove slashes before insert

Sorry, that was in /wp-includes/functions.php at line 460.

[Viper007Bond]

Isn't the whole point of $wpdb->escape() to add slashes so it can safely be inserted into the database?

If there really is a slash problem, then it should be handled on the way out of the database.

And not sure about 2.0.6 vs. 2.0.7, but I've marked it as 2.0.6 just to be safe, especially since this is rather minor.

[markjaquith]

Right now, that's how the function is going to work. You pass unescaped data and it escapes it.

See also #3243