$wpdb->update or $wpdb->insert results in slashes being added in front of quotes

After spending the day on this, the answer is as follows:

WordPress escapes at the $_POST declaration, not at the actual insert, which is bizarre.

$id = stripslashes_deep($_POST['id']); //added stripslashes_deep which removes WP escaping.
$title = stripslashes_deep($_POST['title']);
$message = stripslashes_deep($_POST['message']);

$wpdb->update('table_name', array('id'=>$id, 'title'=>$title, 'message'=>$message), array('id'=>$id));

Doing this will mean that WP will not add slashes before any quotes.

Leave a Comment