addslashes()

The addslashes() function adds a backslash (\) in front of certain characters in a string so they can be safely embedded in code or data. It escapes four characters: the single quote ('), the double quote ("), the backslash (\) itself, and the NUL byte (\0). This is useful when you need to place a string inside another quoted string without the inner quotes breaking the surrounding syntax.

Syntax

addslashes(string $string): string

It takes a single parameter — the string to escape — and returns a new string with the backslashes added. The original string is left unchanged.

Basic example

The string below contains both single and double quotes. Passing it to addslashes() returns a copy with each quote escaped:

The output is:

This is a string with \'quotes\' and \"double quotes\".

Every ' and " now has a backslash in front of it, so the string can be dropped into a quoted context without ending the surrounding string early.

Reversing the result with stripslashes()

addslashes() is the inverse of stripslashes(). Whatever the first one adds, the second one removes, so you can round-trip a value without losing data:

<?php
$original = "O'Reilly's book costs \$5.";
$escaped  = addslashes($original);
$restored = stripslashes($escaped);

echo $escaped . "\n";   // O\'Reilly\'s book costs $5.
echo $restored . "\n";  // O'Reilly's book costs $5.
var_dump($original === $restored); // bool(true)
?>

Only the backslashes that addslashes() itself inserted are removed, so the restored string matches the original exactly.

When to use it

Reach for addslashes() when you need to embed text inside another quoted string — for example, building a string literal for an export file, a config snippet, or output that will later be parsed by eval() (which you should generally avoid). It is a formatting helper, not an escaping function tied to any particular destination.

addslashes() is not a security function

This is the most important point to understand. addslashes() does not make a string safe for SQL queries or HTML output, and using it that way leaves your application vulnerable:

• For database queries, use prepared statements with PDO or mysqli, or mysqli_real_escape_string() for the legacy escaping approach. Unlike addslashes(), mysqli_real_escape_string() is connection- and charset-aware.
• For HTML output, use htmlspecialchars() to neutralize <, >, &, and quotes.

addslashes() is also not multi-byte aware: it operates byte by byte and can corrupt or mis-escape strings in encodings such as Shift-JIS or GBK, which is exactly why it must not be relied on for SQL safety.

Related functions

• stripslashes() — removes the backslashes added by addslashes().
• addcslashes() — lets you choose exactly which characters to escape.
• quotemeta() — escapes regular-expression metacharacters.
• htmlspecialchars() — escapes characters that have special meaning in HTML.

Practice