stripcslashes()

Introduction

The stripcslashes() function in PHP un-escapes a string that contains C-style escape sequences. It interprets sequences such as \n (newline), \t (tab), \r (carriage return), \xHH (hexadecimal), and \NNN (octal), converting each one into the actual character it represents. For a backslash that sits in front of an ordinary character (one that is not part of a recognized sequence), the backslash is simply dropped.

It is the exact inverse of addcslashes(): whatever addcslashes() escapes, stripcslashes() restores. This is its key difference from stripslashes(), which only strips backslashes added by addslashes() and does not interpret escape sequences.

This page covers the syntax, how each kind of escape sequence is decoded, a round-trip with addcslashes(), and the common gotcha around PHP double-quoted strings.

Syntax

stripcslashes(string $string): string

Return value: a new string with the escape sequences decoded. The original string is not modified.

Basic example

In PHP, the double-quoted literal "Hello\\ World\\!" already collapses each \\ to a single backslash, so the value passed to the function is Hello\ World\!. The space and ! are not part of any escape sequence, so stripcslashes() removes the backslashes in front of them. The output is:

Hello World!

Decoding escape sequences

Unlike stripslashes(), stripcslashes() actively converts recognized sequences into real control characters. This example uses single-quoted source strings so the backslashes reach the function untouched:

<?php

echo stripcslashes('Line1\nLine2'), "\n";      // \n becomes a real newline
echo stripcslashes('Column1\tColumn2'), "\n";   // \t becomes a real tab
echo stripcslashes('\x41\x42\x43'), "\n";       // hex codes -> ABC
echo stripcslashes('\101\102\103'), "\n";       // octal codes -> ABC

Output:

Line1
Line2
Column1	Column2
ABC
ABC

Both \x41 (hexadecimal) and \101 (octal) map to character code 65, which is the letter A.

Round-trip with addcslashes()

Because stripcslashes() reverses addcslashes(), escaping a string and then un-escaping it returns the original value exactly:

<?php

$original = "Price: \$5\nNew line";

// Escape the dollar sign and the newline.
$escaped = addcslashes($original, "\$\n");
echo $escaped, "\n";              // Price: \$5\nNew line

$restored = stripcslashes($escaped);
var_dump($original === $restored); // bool(true)

Output:

Price: \$5\nNew line
bool(true)

Single quotes vs. double quotes

The most common confusion with stripcslashes() is who processes the backslashes. PHP itself interprets escape sequences inside double-quoted strings before stripcslashes() ever runs, so a sequence may already be decoded:

<?php

// Double quotes: PHP turns "\n" into a newline first,
// so stripcslashes() never sees the backslash.
echo strlen("\n");                 // 1

// Single quotes: the two characters \ and n are passed
// literally, and stripcslashes() does the decoding.
echo strlen(stripcslashes('\n'));  // 1

Output:

11

When your escape sequences come from an external source (a file, a database, user input), they arrive as literal \ + n characters, so stripcslashes() is the right tool to decode them.

When to use it

• Reversing the output of addcslashes().
• Decoding C-style escape sequences stored as literal text (config values, log lines, data exported from C programs).
• Restoring control characters such as tabs and newlines that were escaped for safe storage or transport.

For plain backslash removal without escape-sequence interpretation, use stripslashes() instead.

Conclusion

stripcslashes() un-escapes strings containing C-style escape sequences, decoding \n, \t, hexadecimal (\xHH), and octal (\NNN) codes into their actual characters and dropping stray backslashes. It is the precise inverse of addcslashes(), which makes it dependable for round-trip escaping. Keep the distinction from stripslashes() in mind, and remember that PHP's own double-quoted strings may decode sequences before the function runs.

Practice