Prevent WordPress from escaping shortcode attributes - wordpress

Question

at the moment I'm developing a plugin, which hooks up to the content editor. My callback receives the post content after editing and calls do_shortcode(), but there is a problem and i don't know how to fix it.
add_filter('wp_insert_post_data', 'prepareContentSaving', 99, 2);
add_filter('wp_update_post_data', 'prepareContentSaving', 99, 2);
For instance if my post looks like (which obviously looks like valid shortcode syntax):
[foo bar="two words"]
my callback receives:
[foo bar=\"two words\"]
Looks right, right? But now whenever the shortcode is parsed via do_shortcode() the arguments are parsed like
[tag argument1=value1 argument2]
instead of
[tag argument="Foo bar"]
which then looks something like this in PHP:
array(
[0]=> string "bar=\"two"
[1]=> string "words\""
)
So how can I prevent the quotes inside the shortcode from being escaped? Is there something wrong with the post data hook? Changing the priority from 99 to 0 doesn't change something either. Am I using the right filter?

Answer 1

You can try to modify your code like this:
$post = array_map('stripslashes_deep', $_POST);
More info link: http://codex.wordpress.org/Function_Reference/stripslashes_deep

Answer 2

WordPress actually doesn't feature any option for preventing shortcodes to be escaped. The only way is to undo it is to convert all '\"' back to '"' (same for single quotes) inside the function 'prepareContentSaving':
add_filter('wp_insert_post_data', 'prepareContentSaving', 99, 2);
add_filter('wp_update_post_data', 'prepareContentSaving', 99, 2);
function prepareContentSaving($data, $post) {
$content = $post['post_content'];
$content = correctShortcodeSlashes($content);
... any further processing ...
$data['post_content'] = $content;
return $data;
}
After saving a post wordpress not only escapes quotes but also escapes backslashes. So '"' becomes '\"' and '\"' (if the editor wants to escape a quote) becomes '\\"'.
The first given PCRE converts all single escaped quotes inside shortcode brackets back to normal quotes, the second one converts all the double escaped ones inside brackets. This way the content stays the same which reduces the chances of code injection.
PHP Manual on preg_replace
function correct_shortcode_slashes($text) {
$attribute_escaped_slashes_pattern = '/(\[)((.|\s)*?)([^\\\\])\\\\("|\')(.*?)(\])/';
$attribute_escaped_slashes_replacement = '$1$2$4"$6$7';
$attribute_double_slashes_pattern = '/(\[)((.|\s)*?)\\\\+("|\')(.*?)(\])/';
$attribute_double_slashes_replacement = '$1$2"$5$6';
$result = $text;
$counter = 0;
while(true) {
$result = preg_replace($attribute_escaped_slashes_pattern, $attribute_escaped_slashes_replacement, $result, -1, $counter);
if($counter === 0) {
break;
}
}
while(true) {
$result = preg_replace($attribute_double_slashes_pattern, $attribute_double_slashes_replacement, $result, -1, $counter);
if($counter === 0) {
break;
}
}
return $result;
}
Please feel free to enhance this answer.