Where variables work

Last updated Oct 3, 20265 min read

Expressions are evaluated when a value is read or drawn, never when it is saved. The database keeps the text you typed (Hello {{ glb.name }}); the visitor sees the result. Changing a Global Data value therefore updates every text that uses it, with no re-saving.

Field values

Every string value that goes through the field runtime is evaluated. That includes:

wpmcf_get_field(), wpmcf_the_field(), wpmcf_get_option_field(), wpmcf_the_option_field()
The [wpmcf_field] shortcode and the WPM Field block
The WPM Fields Block Bindings source
Dynamic tags for Elementor Pro, Bricks, Divi, Breakdance and Oxygen (see integrations)
Field values used as Yoast SEO and Rank Math variables

php

wpmcf_update_field( 'product', 'headline', 'Hello {{ glb.company }} - {{ wp.post_title }}', $post_id );

echo wpmcf_get_field( 'product', 'headline', $post_id );
// Hello Acme - Blue widget

Details:

Rule	Behaviour
Which values	Top-level values that are text. A value inside a group, repeater or flexible content field is not evaluated, because it arrives as a list.
Which field types	Any whose value is a string: text, textarea, WYSIWYG, email, URL and other text-like fields.
When it runs	On every read, after the `wpmcf/field/value` filter.
Output escaping	`wpmcf_the_field()` and the shortcode escape the result for the output format (HTML, attribute, URL), so `<script>` that came from a variable is printed as text. `wpmcf_get_field()` returns the raw result; escape it yourself.
Who may use them	Only values written by someone trusted. See below and Security.
One level only	An expression that reads another field (`{{ fg.group.other }}`) gets that field's stored text; its own `{{ }}` stay as text. A field that refers to itself prints its own raw text.
REST and GraphQL	Return the stored text, not the evaluated one.

Who may use expressions in a field value

The value belongs to	Evaluated?
A post	Only if the post's author has the `unfiltered_html` capability (administrators and editors on a single site; not authors or contributors)
A user profile	Only if that user has `unfiltered_html`
A comment	Never
A term, a widget, an options page	Yes (only people who can open those admin screens can edit them)

A site can change the answer per value with the wpmcf/field/resolve_variables filter. When the answer is no, the text prints exactly as stored, braces included.

Placeholder and default value

In the field builder, a field's Placeholder and Default value accept expressions.

The placeholder is evaluated when the edit screen is drawn (Hi {{ glb.company }} shows Hi Acme). It is a hint, never stored.
The default value (a field's starting value, shown before anything is saved) is evaluated for the object being edited. A default that contains {{ }} is never used as the database column default.
A default value on a field inside a Group or repeater is evaluated the same way.

Both inputs have the {} helper to insert an example.

Global Data

The value of a Global Data variable is evaluated when it is read with wpmcf_get_global(), wpmcf_the_global() or [wpmcf_global]. Only administrators edit Global Data, so there is no per-writer check.

Variable "banner" = Welcome to {{ glb.company }}, open since {{ sys.year }}.
[wpmcf_global key="banner"]   →   Welcome to Acme, open since 2026.

A Global Data value has no object of its own. wp.post_* and fg therefore use the post being displayed, when there is one. On a generated Programmatic SEO page, pseo.* is available as well.

Page builders

Elementor (the free Elementor plugin is enough): {{ }} works in the settings of every element: headings, text editors, button labels, links and anything else typed as text. Expressions are evaluated just before the element renders, for the current post.

Setting	How the result is inserted
Text-like settings	As plain text: tags stripped, special characters escaped, `[` and `]` encoded so no shortcode can run. The text you typed around the variable keeps its own markup.
A `url` (link) setting	If the setting is exactly one variable, its result is the URL. If the variable sits inside a written URL (`https://example.com/{{ glb.slug }}`), the result is URL-encoded. The final URL is sanitized, so `javascript:` is removed.
Settings whose key starts with `_`	Skipped (Elementor internals).

Elements that contain variables are left out of Elementor's element cache, so one post's values are never shown on another. In the Elementor editor, widgets that Elementor previews with JavaScript templates (Heading, Button and similar) show the {{ }} as written; the live page and PHP-rendered previews show the result.

The other builders (Bricks, Divi, Breakdance, Oxygen) read fields through dynamic tags, which use the field runtime above. See integrations.

Programmatic SEO (Pro)

Templates of a Programmatic SEO task are written with pseo.* variables plus everything else on this page.

Template	Notes
URL path (parent and slug)	Tags stripped; the result is normalized into a path
Page title	Tags stripped
SEO title, description and other SEO texts	Tags stripped
Page content, including page-builder content	Values are cleaned for HTML; inside a tag or block comment they are attribute-escaped
Structured data (JSON-LD)	In a raw JSON template, every result is escaped as a JSON string
Post meta of the template when converting pages to posts	Evaluated for each converted page

Field values and Global Data printed on a generated page can also use pseo.*, because the page's data row is added to their evaluation context (through the wpmcf/variables/context filter). See Namespaces for the escaping rules.

Your own PHP

php

echo esc_html( wpmcf_resolve_variables( 'Hello {{ glb.company }}!' ) );

See PHP API for contexts and for extending the engine.

Where variables do not work

Place	Why
Post titles and post content typed in the editor	Nothing evaluates core content. Use the `[wpmcf_field]` or `[wpmcf_global]` shortcode, the field block, or a Programmatic SEO template.
Values inside a group, repeater or flexible content field	They are lists, and only text values are evaluated
Comment fields	Never evaluated, for safety
Post and user values written by people without `unfiltered_html`	Printed as stored
Text read through REST, GraphQL, export files or admin list columns	These show the stored text
The `{{ }}` text that a variable returns	A result is never evaluated again
Password fields and password Global Data	Never readable from an expression

Was this page helpful?

Still stuck? Contact support