Escaping discrepancies with get_option() and update_option()

  • Hi,

    So, update_option() automatically does pre-database escaping, but it doesn’t look as though get_option() unescapes it on the way out. I’m developing a plugin at the moment, and I’m always ending up with escaped apostrophes after get_option(). Is this expected? Strikes me as a bit odd.

    On the same subject, shouldn’t $wpdb->escape() be using mysql_real_escape() instead of addslashes()?

    Here’s my code:

    <?php
function AdminMenuOptions()
{
    global $wpdb;

    if(isset($_POST['hidden']))
    {
        update_option('rb_recaptcha_private', $_POST['rb_recaptcha_private']);
        update_option('rb_recaptcha_public',  $_POST['rb_recaptcha_public']);
        update_option('rb_from_address',      $_POST['rb_from_address']);
        update_option('rb_from_name',         $_POST['rb_from_name']);
        update_option('rb_welcome_email',     $_POST['rb_welcome_email']);
        update_option('rb_welcome_subject',   $_POST['rb_welcome_subject']);
        update_option('rb_post_registration', $_POST['rb_post_registration']);

        echo '<div class="updated fade"><strong>Options saved</strong>
</div>';
    }

    $rb_recaptcha_private   = get_option("rb_recaptcha_private");
    $rb_recaptcha_public    = get_option("rb_recaptcha_public");
    $rb_from_address        = get_option('rb_from_address');
    $rb_from_name           = get_option('rb_from_name');
    $rb_welcome_email       = get_option('rb_welcome_email');
    $rb_welcome_subject     = get_option('rb_welcome_subject');
    $rb_post_registration   = get_option('rb_post_registration');

    require 'admin-screen.php';
}
?>

    get_magic_quotes_gpc is off in my PHP config.

Viewing 1 replies (of 1 total)
  • Thread Starter benlancaster

    (@benlancaster)

    Just to update, I’ve (sort of) fixed this in my plugin with:

    <?php
add_filter('option_rb_welcome_subject', 'stripslashes');
add_filter('option_rb_welcome_email',   'stripslashes');
add_filter('option_rb_from_name',       'stripslashes');
?>
Viewing 1 replies (of 1 total)
  • The topic ‘Escaping discrepancies with get_option() and update_option()’ is closed to new replies.