wp_slash() is lossy

[johnbillion]

Calling wp_slash() converts all values to strings, causing data loss for integers, floats, and booleans.

Example:

wp_slash( 123 ); // '123'
wp_slash( 123.4 ); // '123.4'

The above results in the values being cast to strings.

Booleans are cast to strings too, with a value of '1' or an empty string:

wp_slash( true ); // '1'
wp_slash( false ); // ''

This causes particular problems for delete_metadata() when passing a meta value, because the meta value is slashed before being serialized in order to perform the SQL lookup for matching rows, causing the lookup to fail.

[johnbillion]

Related: https://core.trac.wordpress.org/ticket/24106#comment:10

[andizer]

Unit tests

[jrf]

Anyone any feedback on the question I pose here: https://core.trac.wordpress.org/ticket/24106#comment:12 ?

[ryotasakamoto]

I think that it can be corrected below, but is there something wrong?

function wp_slash( $value ) {
	if ( is_array( $value ) ) {
		foreach ( $value as $k => $v ) {
			if ( is_array( $v ) ) {
				$value[ $k ] = wp_slash( $v );
			} else {
				if (is_bool( $v )) {
					$v = (int) $v;
				}
				$value[ $k ] = addslashes( $v );
			}
		}
	} else {
		if ( is_bool( $value ) ) {
			$value = (int) $value;
		}
		$value = addslashes( $value );
	}

	return $value;
}

[SergeyBiryukov]

Related: #48605

Leave non-string values untouched in wp_slash()

Trac ticket: https://core.trac.wordpress.org/ticket/42195

[donmhico]

In PR-288, only string values are passed to addslashes(). Basically non-string values passed to wp_slash() are just returned.

[whyisjake]

I agree with @jrf that we can simplify this a bit using a map function. Adding a patch that could combine the efforts here and #24106.

[whyisjake]

In 48433:

Formatting: Prevent wp_slash from returning non-strings as strings.

If a bool/float/int is passed into wp_slash it will be coerced into a string.

This changes the behavior to only slash strings. At the same time, handles recursion a little nicer by calling array_map for arrays.

Fixes #42195, #24106.

Props johnbillion, andizer, jrf, ryotasakamoto, SergeyBiryukov, donmhico, TobiasBg, markoheijnen, ryan, nacin, devesine, whyisjake.

[SergeyBiryukov]

Follow-up: #50635

[justinahinon]

Mentionned in Miscellaneous developer changes note: ​https://make.wordpress.org/core/2020/07/29/miscellaneous-developer-focused-changes-in-wordpress-5-5/