Skip to main content

PlaceholderAPI

Integrating PlaceholderAPI allows you to display dynamic server and player statistics (balances, ranks, kill counts, player names) directly in your menus.

Optional Integration

EasyMenu starts normally without PlaceholderAPI. If not present, placeholder strings are simply displayed as literal text.

Supported Locations​

Placeholders (%...%) can be used in:

  • menu-title (Menu titles)
  • name (Item display names)
  • lore (Item lore descriptions)
  • message (Action messages)
  • command (Command arguments)
  • title / subtitle (Screen title actions)
  • open-denied-message / disabled-message (Denial messages)
  • body (Native Dialog body text, including an item's description)
  • label of inputs and display of option entries
  • prompt of the type: input action
  • cooldown.message (the message shown during a cooldown)
  • placeholder conditions (both value and compare)
  • teleport coordinates (world / x / y / z / yaw / pitch)
  • placeholder conditions (Value comparisons)
menu-title: "&6%player_name%'s Profile"

menu-items:
  - slot: 13
    material: PLAYER_HEAD
    name: "&e%player_displayname%"
    lore:
      - "&7Balance: &a$%vault_eco_balance%"
      - "&7Rank: &b%luckperms_primary_group_name%"
      - "&7Playtime: &f%statistic_hours_played% hours"
    command: "stats"
Prohibited in Structural Keys

Placeholders cannot be used in structural menu keys such as slot, menu-size, material, permission nodes, or action types. Use Variants if you need conditional materials.

Expansion Order & Injection Protection​

To guarantee complete security against injection attacks, EasyMenu 7 expands text in a fixed, four-stage order:

1. Trusted Internal Variables   {player}, {menu}, {session}
2. PlaceholderAPI               %placeholder%
3. Color Code Formatting        &a, &l, etc.
4. Player-Supplied Values       {input}, {input.<id>}, {remaining}

Sanitizing Player Input​

Player-supplied values ({input}) are substituted last with all formatting section characters (§) stripped.

If a malicious user submits %vault_eco_balance%, &4RED, or {player} into an input field, it is treated strictly as literal characters and is never re-evaluated as a placeholder, color code, or variable.