id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
11253	update_option escapes input but get_option doesn't un-escape	nullvariable	westi	"Version: WordPress MU 2.8.6

Duplicate the issue:
write any data to an update_option value in the database and include quotes in it.

Problem is in the source code (verified by reading line 167+ of /wp-includes/functions.php)

Server: Apache2, PHP5

Details:
adding an option to the database using update_option() (line 228+ of functions.php) will cause any quotes to be escaped. However output returned by get_option() (line 167+) does not un-escape this value. It seems which PHP5 that even if I escape my own data it get's escaped again so anytime I expect to use html or quotes in an option field I have to make sure there's a stripslashes applied to the get_option output. Makes sense to me that if we escape the content on the way in we should un-escape the content on the way back out. But I could be wrong."	defect (bug)	closed	normal		Plugins	2.8.5	trivial	invalid