Data Variables

Core Forms supports two variable systems for inserting dynamic data into emails, redirects, form markup, and other contexts.

Bracket Variables: [field_name]

Used in email bodies, subjects, headers, and redirect URLs. Processed by cf_replace_data_variables() after form submission.

Field Variables

[field_name]     Value of a specific submitted field
[all]            All fields as "name: value" pairs, separated by <br />
[all:label]      All fields with human-readable labels as "Label: value" pairs

System Variables

Variable	Value
[CF_FORM_ID]	Form post ID
[CF_FORM_TITLE]	Form title
[CF_TIMESTAMP]	Submission timestamp (Y-m-d H:i:s)
[CF_IP_ADDRESS]	Submitter’s IP address
[CF_USER_AGENT]	Browser user agent string
[CF_REFERRER_URL]	Page URL where form was submitted

Payment Variables (4.1)

Available on submissions that went through a payment gateway. Empty string for free submissions.

Variable	Value
[CF_PAYMENT_STATUS]	pending_payment / paid / payment_failed / refunded
[CF_PAYMENT_PROVIDER]	stripe / paypal / razorpay / polar
[CF_PAYMENT_ID]	Provider-issued payment id (Stripe session id, PayPal order id, etc.)
[CF_PAYMENT_AMOUNT]	Major-unit decimal, two places (19.99, or 1500 for JPY)
[CF_PAYMENT_AMOUNT_FORMATTED]	Currency code + amount (USD 19.99)
[CF_PAYMENT_CURRENCY]	ISO-4217 code (USD, EUR, INR, JPY)

These variables are populated after the webhook confirms payment, so they only resolve correctly inside actions that fire from cf_form_success (which payment-required forms trigger from the webhook handler, not from the initial submit). Use them for receipt emails:

Thanks for your order!

Order: [CF_PAYMENT_ID]
Total: [CF_PAYMENT_AMOUNT_FORMATTED]

How It Works

// Replace variables in a string using submission data
$result = cf_replace_data_variables( $string, $submission, $escape_function );

The third parameter controls escaping: – 'strip_tags' — Strip HTML (used for subjects, headers) – 'esc_html' — Escape HTML entities (used for HTML email bodies) – null — No escaping (used for plain text email bodies)

Example: Email Subject

New [inquiry_type] from [name] - [CF_FORM_TITLE]

Becomes:

New Sales Inquiry from Jane Smith - Contact Form

Example: Redirect URL

https://example.com/thank-you?name=[name]&ref=[CF_FORM_ID]

Example: Email Body

Hello,

You received a new submission from [name] ([email]).

Form: [CF_FORM_TITLE]
Submitted: [CF_TIMESTAMP]
IP: [CF_IP_ADDRESS]

--- All Fields ---
[all:label]

[all] vs [all:label]

[all] outputs field names as-is:

first_name: Jane
last_name: Smith
email: jane@example.com

[all:label] converts field names to labels:

First Name: Jane
Last Name: Smith
Email: jane@example.com

The label format converts underscores to spaces and capitalizes words.

Template Tags: {{tag.field}}

Used in form markup (HTML) for pre-filling fields and dynamic content. Processed by cf_template() before the form is rendered.

Built-in Tags

{{user.field}}

Access current WordPress user properties:

<input type="text" name="name" value="{{user.display_name}}" />
<input type="email" name="email" value="{{user.user_email}}" />
<input type="hidden" name="user_id" value="{{user.ID}}" />

Available properties (allowlisted since 4.9.0): ID, user_login, user_email, user_nicename, user_url, display_name, first_name, last_name, nickname, description, roles.

Anything else resolves to an empty string. This is a security boundary, not a convenience: cf_template() also runs over submitted values, so before 4.9.0 a logged-in visitor who typed {{user.user_pass}} into any text field had their password hash written into the stored submission, the CSV export and the notification email. Extend the list with the cf_template_user_fields filter only when you are sure the value is safe to store and email.

{{post.field}}

Access the current post or page properties:

<input type="hidden" name="page_id" value="{{post.ID}}" />
<input type="hidden" name="page_title" value="{{post.post_title}}" />

Available properties (allowlisted since 4.9.0): ID, post_title, post_name, post_type, post_status, post_date, post_modified, post_author, post_excerpt, plus the friendly aliases title, slug and url.

post_password is deliberately excluded. Extend with cf_template_post_fields.

The aliases matter: {{post.title}} and {{post.url}} appear throughout the older documentation but resolved to nothing before 4.9.0, because WP_Post has post_title and no url property at all. Both now work, and {{post.url}} returns the permalink.

{{url_params.field}}

Access URL query parameters:

<!-- For URL: ?ref=newsletter&campaign=spring -->
<input type="hidden" name="referral" value="{{url_params.ref}}" />
<input type="hidden" name="campaign" value="{{url_params.campaign}}" />

Fallback Values

Use || to provide a fallback when a tag is empty:

<input type="text" name="name" value="{{user.display_name || Guest}}" />

Custom Template Tags

Register your own tags via the cf_template_tags filter:

add_filter( 'cf_template_tags', function( $tags ) {
    // Simple scalar value
    $tags['site'] = [
        'name'  => get_bloginfo( 'name' ),
        'url'   => home_url(),
        'email' => get_option( 'admin_email' ),
    ];

    // Callable that accepts a field parameter
    $tags['company'] = function( $field ) {
        $data = [
            'name'    => 'Acme Corp',
            'phone'   => '+1-555-0100',
            'address' => '123 Main St',
        ];
        return $data[ $field ] ?? '';
    };

    return $tags;
} );

// Usage: {{site.name}}, {{company.phone}}

Tag Syntax

{{ tag.field }}           Basic replacement
{{ tag.field || fallback }} With fallback value
{{ tag }}                  Scalar value (no field)

Whitespace around {{ and }} is optional.

Where Each System Is Used

Context	System	Function
Email subject	Bracket [var]	cf_replace_data_variables()
Email message body	Bracket [var]	cf_replace_data_variables()
Email headers	Bracket [var]	cf_replace_data_variables()
Redirect URL	Bracket [var]	cf_replace_data_variables()
Action settings	Bracket [var]	cf_replace_data_variables()
Form HTML markup	Template {{tag}}	cf_template()
Default field values	Template {{tag}}	cf_template()

Related

• Email Action
• Autoresponder Action
• Hooks Reference