addslashes and json_encode not working together

Question

$val = "I'm string";

For this type of string I am using the addslashes function, which convert string into like this:

"I\'m string"

and store into the database. When I get all data from database in array of fields and passed array in

json_encode($arr);

In response I get the string with a extra slash like this:

"I\\'m string"

And I wanted to remove that extra slash which is added by json_encode. how I do that??

You shouldn't be using addslashes with databases. Use prepared statements. It looks like you're actually adding a literal slash to your string instead of escaping the apostrophe. — Devon Bessemer
– Devon Bessemer, Commented Jul 3, 2018 at 13:02
Use prepared parameterized statements in either the MYSQLI_ or PDO API's and this problem dissappears and you dont need strip or add slashes anywhere — RiggsFolly
– RiggsFolly, Commented Jul 3, 2018 at 13:04
If you use prepared statement correctly, you don't need addslashes — Adder
– Adder, Commented Jul 3, 2018 at 13:07
This questions attracts lots of answers which are downvoted. This would not happen if you had shown your code for writing to the database — Adder
– Adder, Commented Jul 3, 2018 at 13:10

Timmetje · Accepted Answer · 2018-07-03 14:59:26Z

If you really want an answer to this question you can reverse your addslashes with stripslashes.

But never use addslashes function to escape values you are going to send to mysql.

Use native prepared statements, mysqli_real_escape_string() or PDO::quote.

BUT NOTE:

Don't use a vulnerable character set for connection encoding (use utf8 or something)
Use a higher version of MySQL than 5.7.6.

It is safe enough if you are using quotes around the variables.
@RiggsFolly The bug NO_BACKSLASH_ESCAPES was already fixed in 5.7.6. And both functions are safe. But you were right it should mention you need a higher version than 5.7.6. The character issues are documented in PHP docs.

Script47 · Accepted Answer · 2018-07-03 13:03:02Z

However, you should use prepared statements. That way you don't need to worry about escaping your values.

Loek · Accepted Answer · 2018-07-03 13:07:14Z

It might even be possible with this (though I thought it was forward slash / only:

json_encode($array, JSON_UNESCAPED_SLASHES);

But heed to the comments and Script47's answer and just fix it properly.

Woah nice, those downvotes. Would love some feedback on my answer since you all think it's clearly wrong? Prepared statements will fix OP's problem.

3 Answers 3