“Remember when i said we need to unescape, slashes when getting data out of database? Here is how to do it:”

Sorry, but both of those are quite wrong :<

Escaping data is for the *TRANSPORT* between PHP, and your database – once your database has received that data, it will store it without the escaping slashes. When you SELECT it back out, the slashes won't be there. If you're seeing extra slashes in your data, it means you're escaping TWICE, which is not a good idea, and can actually open some rather nasty security HOLES.

What you're seeing is because WordPress automatically escapes all inputs, just like magic_quotes_gpc does, and yes, it suffers from the same issues ( as detailed here http://php.net/magic_quotes ).

If you're using stripslashes at all, you should be using it BEFORE you use your database specific escaping function, like mysql_real_escape_string(). This way mysql_real_escape_string() is fed the actual content you want to store in the database, and it'll work correctly.

You shouldn't ever need stripslashes() when SELECT'ing data out from your database.

$theValue = function_exists(“mysql_real_escape_string”) ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
$theValue = htmlentities($theValue, ENT_QUOTES, ‘UTF-8′);
trim($theValue);
switch ($theType) {
case “text”:
$theValue = ($theValue != “”) ? “‘” . $theValue . “‘” : “NULL”;
break; case “long”:
case “int”:
$theValue = ($theValue != “”) ? intval($theValue) : “NULL”;
break; case “double”:
$theValue = ($theValue != “”) ? “‘” . doubleval($theValue) . “‘” : “NULL”;
break; case “date”:
$theValue = ($theValue != “”) ? “‘” . $theValue . “‘” : “NULL”;
break; case “defined”:
$theValue = ($theValue != “”) ? $theDefinedValue : $theNotDefinedValue;
break; } return $theValue;}}

Recursive functions come in handy here…
function __stripslashes($var)
{
$var = is_array($var) ? array_map(‘__stripslashes’, $var) : stripslashes($var);

return $var;
}
function __htmlspecialchars($var, $style)
{
$var = is_array($var) ? array_map(‘__htmlspecialchars’, $var, array_fill(0, count($var), $style)) : htmlspecialchars($var, $style);

return $var;
}
$_GET = __stripslashes($_GET);
$_GET = __htmlspecialchars($_GET, ENT_QUOTES);