PHP string function addcslashes()

The addcslashes() function returns a string with a backslash (\) added before every character you list in a "character list." The name comes from C-style escaping: unlike addslashes(), which only ever escapes the four fixed characters ', ", \, and NUL, addcslashes() lets you decide which characters get escaped.

This page covers the syntax, how to escape both single characters and whole ranges, the gotchas to watch for, and when to reach for addcslashes() versus a safer alternative.

Syntax

addcslashes(string $string, string $characters): string

The function takes two parameters, both required:

• $string — the input string to process.
• $characters — the list of characters to escape. You can list characters individually ("W3d") or as a range with .. ("a..z").

Return Value

It returns a new string with a backslash inserted before each character that appears in $characters. The original string is not modified, since strings in PHP are passed by value.

Note that some characters are escaped in C style rather than with a literal backslash: characters with ASCII codes 32 and below or 127 and above are converted to their C escape sequence (for example a newline becomes \n, a tab becomes \t, and other control characters become octal like \037).

Escaping single characters

The simplest use is listing the exact characters you want to escape.

Example 1

Output:

Hello\, World!

Only the comma was in the character list, so only the comma gets a backslash in front of it.

Example 2

You can list several characters at once. Each occurrence of any listed character is escaped, and matching is case-sensitive — escaping "W" does not affect a lowercase "w".

Output:

\Websites like \W\3\docs are a great resource for learning PHP.

Both "W" characters, the "3", and the "d" were each prefixed with a backslash. The lowercase letters were untouched.

Escaping a range of characters

To escape a contiguous run of characters, give a start and end separated by ... For example, "A..Z" escapes every uppercase letter and "0..9" escapes every digit:

<?php

$string = "Price: 25 USD";

// escape every digit 0–9
$escaped_string = addcslashes($string, "0..9");

echo $escaped_string;

?>

Output:

Price: \2\5 USD

The range must be increasing. Writing "z..a" (descending) does not produce the range a to z; PHP emits a warning and treats the dots literally instead. Always put the lower code point first.

Common pitfalls

• Escaping \0, \r, \n, \t is dangerous. These have special meaning in C escape sequences. If you pass them in $characters you can end up converting characters in ways you did not intend, so avoid them unless you know exactly what you want.
• Matching is case-sensitive. Include both cases (for example "Ww" or the range "A..z") if you need to catch both.
• The original string is unchanged. addcslashes() returns a new string; remember to assign or use its return value.

When to use it

Reach for addcslashes() when you need to escape a custom set of characters — for instance building a string for a system that treats certain characters specially. For the common task of escaping quotes and backslashes for legacy string handling, use addslashes() instead. To escape characters for regular expressions, use quotemeta(), and to make user input safe for HTML output, use htmlspecialchars().

To reverse the escaping that addcslashes() applies, use stripcslashes().

Important: addcslashes() is not a security feature. Never rely on it to prevent SQL injection or to sanitize HTML — use prepared statements and htmlspecialchars() for those jobs.

Conclusion

The addcslashes() function escapes a custom set of characters in a string using C-style rules, giving you finer control than addslashes(). List the characters individually or as an increasing .. range, remember that matching is case-sensitive and that control characters are converted to escape sequences, and pair it with stripcslashes() when you need to undo the escaping.

Practice