Why check if stripslashes function exists?

Question

I've found the following code that checks if the stripslashes() function exists.

if ( function_exists( 'stripslashes' ) ) {
    // Do something
} else {
    // Do something
}

The stripslashes() function works on PHP4 and PHP5, so I wonder why it needs a conditional statement to check if the function exists. I don't get it.

It's not a subjective question. Just tell me what is the difference between the usage of this statement and not using it. Thanks in advance!

Here are related links as to where they were used:

*Good question*. TBH, I don't know. Maybe to check if some coder went and created a custom function called the same, or somebody hacked the core and removed it? However, same thing goes for `if ( function_exists( 'mysql_real_escape_string' ) )`. If a server doesn't support those old and deprecated `mysql_` functions, then the conditional statement is needed. — Funk Forty Niner, Nov 04 '15 at 18:12
*"I've found the following code that checks if the stripslashes() function exists."* - Care to share that link? — Funk Forty Niner, Nov 04 '15 at 18:15
Maybe they figure the function will be removed some day, as the thing it was mainly used for was removed? — Alexander O'Mara, Nov 04 '15 at 18:16
@Fred-ii-, yes, here there is the complete code: http://stackoverflow.com/questions/23224463/php-contact-form-will-not-submit. I couldn't found the original source, though. Thanks! — Unix, Nov 04 '15 at 18:24
@Gerard TBH (again), I don't know. Maybe there's a *method to their madness*. I don't see the reason for using it (I think that function is going to stay around for a while). Personally, the `function_exists()` should only be used against probable deprecated functions. `mysql_` being one of them and `session_register()` http://php.net/manual/en/function.session-register.php - I'm sure there are more. (Oh, and you're welcome). — Funk Forty Niner, Nov 04 '15 at 18:26
My guess is they are trying to detect magic quotes, but doing it wrong. — Alexander O'Mara, Nov 04 '15 at 18:28
@Gerard I hope what we've given you (so far, Alexander and I) helped you with your question. — Funk Forty Niner, Nov 04 '15 at 18:35
Here are the [docs](http://php.net/manual/en/function.function-exists.php) *"Checks the list of defined functions, both built-in (internal) and user-defined, for function_name."* — Jay Blanchard, Nov 04 '15 at 18:37
Yes, I'm gonna remove that conditional statement at the moment. Anyway, all the code of this contact form needs a full revision. I searched it in Google and the first indexation is of the year 2009 (close to 7 years ago). This is the original source (I think): http://trevordavis.net/blog/wordpress-jquery-contact-form-without-a-plugin/ — Unix, Nov 04 '15 at 18:50
@Gerard Ok, actually it's listed in the manual from contributed notes http://php.net/manual/en/function.stripslashes.php and it seems to have something to do with magic_quotes_gpc as per what Alexander said earlier. I'm sure we'll find many other hits containing that conditional statement. — Funk Forty Niner, Nov 04 '15 at 18:52
@Fred-ii-, exactly. Alexander was right about it. The good checking seems to be this one: `if ( get_magic_quotes_gpc() ) { return stripslashes( $string ); } else { return $string; }` — Unix, Nov 04 '15 at 19:00
Since @AlexanderO'Mara was *right on the money* from the get-go, I think he (if he wants to that is) should post an answer in order to close the question Gerard. Along with what you posted just above. *Cheers* — Funk Forty Niner, Nov 04 '15 at 19:02
However Gerard, I might also post a complimentary answer also with what I mentioned above (it might prove useful for future readers), while/yet accepting Alexander's answer once he puts it up. @AlexanderO'Mara No problem Alexander, thanks. *Cheers* — Funk Forty Niner, Nov 04 '15 at 19:08
@AlexanderO'Mara Nicely done. I posted one myself. I am by no means looking to gain anything from it, but for others visiting the question. — Funk Forty Niner, Nov 04 '15 at 21:12

score 3 · Accepted Answer · answered Nov 04 '15 at 21:02

There used to be a feature in PHP known as magic quotes, which while well-intentioned, has caused endless confusion.

Most likely this code is intended to detect magic quotes, however this is not the correct way to do this, especially since it does not work.

The correct way to detect if magic quotes are enabled is to use the fuction made for the purpoes, get_magic_quotes_gpc like so.

if (get_magic_quotes_gpc()) {

Or perhaps the following, if you are concerned this will be removed.

if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {

That being said, the whole magic quotes feature was removed back in PHP 5.4, so unless you need to support obsolete versions of PHP, you can just forget the whole thing ever existed (unless you use WordPress that is...).

On a side note, I suppose it's possible the stripslashes function may be removed in the future, and may not have existed at one point, but in this context that's probably not the reason.

Great answer Alexander. – Funk Forty Niner Nov 04 '15 at 21:06 — Funk Forty Niner, Nov 04 '15 at 21:06

Funk Forty Niner · Answer 2 · 2015-11-04T21:21:12.657

Sidenote: Transcribed from some of my comments (slightly modified) to supply the question with a complimentary answer to that of Alexander's.

This is probably to check if some coder went and created a custom function called the same (a method to someone's madness?), or somebody hacked the PHP core and removed it; I'm speculating of course, it's not impossible.

However, the same thing goes for if ( function_exists( 'mysql_real_escape_string' ) ).

If a server doesn't support those old and deprecated mysql_ functions, then the conditional statement is needed and would prove to be effective/useful for something of that nature to be used.

References: (mysql_ removed as of PHP 7, and other deprecation notices)

Personally, function_exists() should only be used against probable deprecated functions; mysql_ being one of them and session_register() - I'm sure there are more.

It's listed in the manual from contributed notes http://php.net/manual/en/function.stripslashes.php and it seems to have something to do with magic_quotes_gpc as per what Alexander (O'Mara) said in comments.

N.B.:

I am by no means looking to gain anything from this, but for others visiting the question.

Good addition. I've seen some pretty hacked up PHP installs. Some people look for security in all the wrong places. — Alexander O'Mara, Nov 04 '15 at 21:15
@AlexanderO'Mara Thanks Alexander. Reminds me of the days when I used to hack my `command.com` file. Ah, the days of DOS. *Cheers* — Funk Forty Niner, Nov 04 '15 at 21:16

Why check if stripslashes function exists?

2 Answers2