title: Does posting data with a textarea automatically add slashes to (escape) the text?
body: <p>Ok, so I'm having a problem with a simple textarea. I'm using a kind of hidden page to easily encode some data using JSON. However, all of my text input is automatically being escaped somewhere and I don't know where. All of my $_POST variables are automatically run through the <code>htmlentities()</code> function when the script starts up, as seen below:</p>
  
  <pre><code>$ani-&gt;i-&gt;post = $this-&gt;clean($_POST, true);
  function clean($values, $unset = false) {
      if (is_array($values)) {
          foreach ($values as $key =&gt; $value) {
              $newkey = strtolower($key);
              $return[$newkey] = $this-&gt;clean($value);
              unset($values[$key]);
          }
          return $return;
      }
      return htmlentities($values);
  }
  </code></pre>
  
  <p>I keep getting <code>\'</code> for all of my single quotes when I put the value back into the textarea.</p>
  
  <p>I can't find anywhere where it would be adding slashes and I don't remember it being a feature that they were automatically added when you submit from a textarea, and if that was so, why would they not be returning back to a single quote when put back into the textarea? Do I really need to run variables through <code>stripslashes()</code> to get them back to their original form?</p>
  
  <p><strong>Edit:</strong> My 'test.php' file is as follows:</p>
  
  <pre><code>&lt;h1&gt;To Be Encoded:&lt;/h1&gt;
  &lt;form action="/test" method="post"&gt;
  &lt;textarea name="encode" rows="20" cols="50"&gt;&lt;?= html_entity_decode($ani-&gt;i-&gt;post['encode']) ?&gt;&lt;/textarea&gt;
  &lt;input type="submit" name="submit" value="Encode It!" /&gt;
  &lt;/form&gt;
  &lt;h1&gt;Encoded By JSON:&lt;/h1&gt;
  &lt;textarea name="encoded" rows="20" cols="50"&gt;&lt;?= json_encode(html_entity_decode($ani-&gt;i-&gt;post['encode'])) ?&gt;&lt;/textarea&gt;
  &lt;?php
  
  die();
  
  ?&gt;
  </code></pre>
  
  <p>P.S. The <code>die()</code> is just there for compatibility with my framework.</p>