On the client side, I'm working with array of JavaScript objects. On submit I need to send it to PHP with form and manipulate the data further on the server-side.
So when building or changing an array of objects on the JavaScript side, I'm saving it to hidden input. It is passes with the form as expected, but the problem is that json_decode returns NULL if I don't stripslashes before decoding it.
Magic Quotes are off as I use PHP > 5.5, and get_magic_quotes_gpc() always returns FALSE.
Why do I need stripslashes in this case, and will this be the case on any production server with magic quotes off?
P.S.: Currently I'm still working on a development environment on Windows and an EasyPHP local server.
Posted data on server side looks like (var_dump):
I'm using WordPress as a container of my application.
string(5045) "[{\"address_components\":[{\"long_name\":\"Flughafenstrasse\",\"short_name\":\"Flughafenstrasse\"...
The application that I was working on was as a WordPress plugin, as it was integrated in WordPress. And it turns out that WordPress (as of current version: 3.8.1) adds slashes (quotes) to GET and POST data on load. And even with PHP > 5.4 and get_magic_quotes_gpc returning 0 data is still escaped.
The solution is simply to stripslashes if you use WordPress, but who knows when WordPress will disable such behaviour and your application will have issues again :)
Some links for the issue: