[wp-trac] [WordPress Trac] #35898: Customizer eats backslashes when sanitizing (including updates for nav menus and some widgets)

[WordPress Trac]

#35898: Customizer eats backslashes when sanitizing (including updates for nav
menus and some widgets)
--------------------------+--------------------------
 Reporter:  westonruter   |       Owner:  westonruter
     Type:  defect (bug)  |      Status:  accepted
 Priority:  normal        |   Milestone:  4.5
Component:  Customize     |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:
--------------------------+--------------------------

Comment (by azaozz):

 The slash/unslash strikes again... Everything that is in `$_POST` and
 `$_GET` gets slashes. As far as I know that has been there since the b2
 fork, ~13 years ago.

 Because of this every function that deals with `$_POST` and `$_GET`
 directly has to run `wp_unslash()`. The only way to call such functions
 from other parts is to use `wp_slash()` as you're doing in the patch.

 As each widget is saved individually from the Widgets screen, it seems the
 few `stripslashes()` calls are indeed left over from before 2.7 when that
 screen was redesigned. It's strange that hasn't been noticed and fixed for
 so many years...

--
Ticket URL: <https://core.trac.wordpress.org/ticket/35898#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform