[wp-trac] [WordPress Trac] #35795: `update_metadata()` double-unslashes meta key when using `add_metadata()`

[WordPress Trac]

#35795: `update_metadata()` double-unslashes meta key when using `add_metadata()`
--------------------------------+-----------------------------
 Reporter:  jdgrimes            |      Owner:
     Type:  defect (bug)        |     Status:  new
 Priority:  normal              |  Milestone:  Awaiting Review
Component:  Options, Meta APIs  |    Version:  trunk
 Severity:  normal              |   Keywords:
  Focuses:                      |
--------------------------------+-----------------------------
 When `update_metadata()` detects that the metadata doesn't exist in the
 database yet, it calls `add_metadata()` instead of continuing on with the
 "update" itself. Because the `$meta_key` and `$meta_value` are unslashed
 by both the `update_metadata()` and `add_metadata()` functions, the values
 saved in the database will be incorrect. This was fixed for the
 `$meta_value` in #17343. However, the `$meta_key` is still unslashed
 twice.

 It isn't possible to work around this by just slashing the value twice
 before passing it to `update_metadata()`, because if the value already
 existed in the database (and so `add_metadata()` wouldn't be used) the
 value would only be unslashed once.

 So there is no way to pass the data to `update_metadata()` in such a way
 that it won't end up being either too slashed or too unslashed part of the
 time.

 I discovered this because I was saving some metadata for some objects
 whose slugs I had designed `to\be\namespaced` in some cases. The slug
 (slashed once with `wp_slash()`) was being used as the meta key, which
 worked except when using `update_metadata()` when the meta key didn't yet
 exist in the database—then all the slashes were ripped out.

 {{{#!php
 // Assumes that the meta key 'test\slashing' doesn't exist.
 update_post_meta( $post_id, wp_slash( 'test\slashing' ), 'value' );

 // get_metadata() doesn't unslash the key, so we don't need to slash it as
 above.
 $value = get_post_meta( $post_id, 'test\slashing', true );

 // $value will be '', should be 'value'.

 // Now $value will be 'value'.
 $value = get_post_meta( $post_id, 'testslashing', true );
 }}}

 Related: #27421

--
Ticket URL: <https://core.trac.wordpress.org/ticket/35795>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform