Most content is double-escaped in the database

[DJPaul]

Throughout BuddyPress, a lot of input (i.e. xprofile data, group name, group description) is being stored double-escaped in the database. This is demonstrated by creating a group with an apostrophe in its group description field, and then by creating a regular WP post with the same phrase, and comparing the contents of the database tables.

This is because WordPress, in wp_magic_quotes(), escapes everything in $_POST, $_GET and $_COOKIE. BuddyPress needs to stripslashes() on relevant content before we put it into the database, as $wpdb->prepare() escapes the input again.
This problem hasn't been very visible due to stripslashes() being added to most template tag's output functions, and a few local workarounds, but ticket #1209 led me to find this issue.

Related:
#1209
#2283

bp_core_action_search_site

The patch for bp_core_action_search_site fixes this issue when performing a search from the site-wide search box in BP-Default's header, as well as improving logic of the patch and catching a few WP_DEBUG warnings.

bp_core_action_search_site 2

bpcore-2.patch is updated to include a bit I missed including in the patch, and also handles the other directories' search boxes in the same way.

bpcore-2.patch looks clean to me.

(In [3511]) Fix double-escaping of search string when performing search from the site-wide search box. Partially addresses #2776.

xprofile 1

T

xprofile-1 address double-escaping of data in the database throughout the xprofile component.
This patch also has fixes for #2694 and #2777 as they are related. It also reverts [3509] #2283 as the issue is best addressed when data is put into the database, rather than on output.

I have tested it a lot and it seems to work as expected, both in the database as well as in the front-end and admin UIs. I have not tested the impact of the patch on existing xprofile data; search will not work on previously-escaped characters, such as apostrophes, but we need to check if we get any slashes output on the front-end and admin UIs. If so, we may need to (re)add extra stripslashes() to maintain this backwards compatibility.

xprofile 2

xprofile-2 patch removes a filter which is unnecessary.

DJPaul, am I correct that you will be punting this?

Yes, not enough time to go through this properly.