PlaceholderAPI

Integrating PlaceholderAPI allows you to display dynamic server and player statistics (balances, ranks, kill counts, player names) directly in your menus.

:::info Optional Integration EasyMenu starts normally without PlaceholderAPI. If not present, placeholder strings are simply displayed as literal text. :::

---

Supported Locations

Placeholders (%...%) can be used in:

• menu-title (Menu titles)
• name (Item display names)
• lore (Item lore descriptions)
• message (Action messages)
• command (Command arguments)
• title / subtitle (Screen title actions)
• open-denied-message / disabled-message (Denial messages)
• body (Native Dialog body text)
• placeholder conditions (Value comparisons)

menu-title: "&6%player_name%'s Profile"

menu-items:
  - slot: 13
    material: PLAYER_HEAD
    name: "&e%player_displayname%"
    lore:
      - "&7Balance: &a$%vault_eco_balance%"
      - "&7Rank: &b%luckperms_primary_group_name%"
      - "&7Playtime: &f%statistic_hours_played% hours"
    command: "stats"

:::warning Prohibited in Structural Keys Placeholders cannot be used in structural menu keys such as slot, menu-size, material, permission nodes, or action types. Use Variants if you need conditional materials. :::

---

Expansion Order & Injection Protection

To guarantee complete security against injection attacks, EasyMenu 7 expands text in a fixed, four-stage order:

1. Trusted Internal Variables   {player}, {menu}, {session}
2. PlaceholderAPI               %placeholder%
3. Color Code Formatting        &a, &l, etc.
4. Player-Supplied Values       {input}, {input.<id>}, {remaining}

Sanitizing Player Input

Player-supplied values ({input}) are substituted last with all formatting section characters (§) stripped.

If a malicious user submits %vault_eco_balance%, &4RED, or {player} into an input field, it is treated strictly as literal characters and is never re-evaluated as a placeholder, color code, or variable.