Create a PHP Token in QC Dynamic Replacer

Create a PHP Token when a value genuinely needs trusted server-side PHP rather than a normal text/HTML Token or QCDR's built-in Joomla dynamic-data providers. PHP Tokens require Max/All Access and the Manage PHP Tokens Joomla permission.

New executable code deserves a controlled rollout. QCDR validates PHP syntax when you save it, but it does not sandbox or semantically review what the code will do at runtime.

Before You Create the Token

  • Confirm QCDR Effective tier is Max or All Access.
  • Use an Administrator account with both Token management access and Manage PHP Tokens.
  • Decide whether a built-in Joomla content / dynamic data source can solve the requirement without custom PHP.
  • Review the PHP for database writes, filesystem changes, outbound calls, mail, or other side effects.

Create the PHP Token

  1. Open Components > QC Dynamic Replacer > Tokens and choose to create a Token.
  2. Enter the Token name and friendly title. New Tokens begin in Draft unless you deliberately choose another state.
  3. For Output type, choose PHP code.
  4. Leave Execution on Once per page request — Recommended unless the PHP is intentionally safe for repeated execution.
  5. Enter the PHP code body. You do not need to type <?php or ?>; QCDR also tolerates those outer wrappers when pasted.
  6. Leave PHP errors in output on Hide PHP errors — Recommended for normal use.
  7. Configure any page/audience/schedule/IP/condition targeting needed to keep the Token narrow.
  8. Save the Token.

What Save-Time Validation Does

QCDR requires non-empty PHP code and asks PHP's parser to validate its syntax without executing it. A syntax error blocks the save and reports a sanitized syntax message.

Passing syntax validation does not prove the code is safe or logically correct. Database names, APIs, files, classes, and runtime state can still fail when the frontend request actually executes the Token.

Test Before Broad Deployment

Place the Token placeholder on a controlled frontend page, or use it as a Rule replacement with narrow targeting. Enable the Token only when you are ready to execute it, then request that exact frontend context and verify the output and any expected side effects.

Token-backed Rules do not execute a PHP replacement speculatively before a real Rule match is found. This reduces unnecessary execution, but PHP still runs when an eligible match actually needs the Token.

Use a Simple First Test

For an initial functional check, use code that only echoes a harmless marker and has no external side effects. After confirming the Token path works, replace it with the reviewed production logic and retest.

After Deployment

Keep error display on Hide, monitor Joomla/QCDR logs for PHP Token warnings, and revisit Every occurrence code after any change that could make repeated execution unsafe. If the site loses Max-level entitlement, QCDR preserves the Token configuration but does not execute it until eligible access returns.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.