acf_form_front::render_form │ public │ ACF 5.4.0

Renders a front-end ACF form.

Accepts either an array of form configuration (validated via validate_form()) or the string id of a form previously registered with acf_register_form(). Outputs the form HTML directly.

Method of the class: acf_form_front{}

No Hooks.

Returns

false|void. False if a registered form id was passed and no matching form exists; otherwise outputs the form and returns no value.

Usage

$acf_form_front = new acf_form_front();
$acf_form_front->render_form( $args );

$args(array|string)

Form configuration array, or the id of a registered form.
Default: array()

Changelog

acf_form_front::render_form() acf form front::render form code ^{ACF 6.8.8}

<?php
function render_form( $args = array() ) {

	// Vars.
	$is_registered = false;

	// Allow form settings to be directly provided.
	if ( is_array( $args ) ) {
		$args = $this->validate_form( $args );

		// Otherwise, lookup registered form.
	} else {
		$is_registered = true;
		$args          = $this->get_form( $args );
		if ( ! $args ) {
			return false;
		}
	}

	// Extract vars.
	$post_id = $args['post_id'];

	// Prevent ACF from loading values for "new_post".
	if ( $post_id === 'new_post' ) {
		$post_id = false;
	}

	// Set uploader type.
	acf_update_setting( 'uploader', $args['uploader'] );

	// Discover the fields this form will expose.
	$fields = $this->get_form_fields( $args );

	// Load values for the special _post_title / _post_content fields so they
	// render pre-populated with the current post's data.
	foreach ( $fields as &$field ) {
		if ( ! isset( $field['key'] ) ) {
			continue;
		}
		if ( $field['key'] === '_post_title' ) {
			$field['value'] = $post_id ? get_post_field( 'post_title', $post_id ) : '';
		} elseif ( $field['key'] === '_post_content' ) {
			$field['value'] = $post_id ? get_post_field( 'post_content', $post_id ) : '';
		}
	}
	unset( $field );

	// Display updated_message
	if ( ! empty( $_GET['updated'] ) && $args['updated_message'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Used as a flag; data not used.
		printf( $args['html_updated_message'], $args['updated_message'] ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- designed to contain potentially unsafe HTML, set by developers.
	}

	// display form
	if ( $args['form'] ) : ?>
		<form <?php echo acf_esc_attrs( $args['form_attributes'] ); ?>>
		<?php
	endif;

	// Render hidden form data.
	$render_id      = $this->get_render_id();
	$acf_form_value = $is_registered ? $args['id'] : acf_encrypt( wp_json_encode( $args ) );
	acf_form_data(
		array(
			'screen'    => 'acf_form',
			'post_id'   => $args['post_id'],
			'form'      => $acf_form_value,
			'render_id' => $render_id,
		)
	);

	/**
	 * Emit a per-form metadata token. PHP keeps only the last `_acf_form` input
	 * after browser-level dedup, so multiple acf_form() calls inside a single
	 * outer <form> would otherwise lose all but one form's allow-list —
	 * `_acf_form_meta[]` uses the array form to survive that and carries each
	 * form's contribution.
	 */
	$meta = wp_json_encode(
		array(
			'render_id'          => $render_id,
			'form_anchor'        => hash( 'sha256', (string) $acf_form_value ),
			'target_post_id'     => (string) $args['post_id'],
			'issued_at'          => time(),
			'allowed_field_keys' => $this->get_allowed_field_keys( $args, $fields ),
			'post_title'         => (bool) $args['post_title'],
			'post_content'       => (bool) $args['post_content'],
		)
	);
	acf_hidden_input(
		array(
			'name'  => '_acf_form_meta[]',
			'value' => acf_encrypt( $meta ),
		)
	);

	?>
	<div class="acf-fields acf-form-fields -<?php echo esc_attr( $args['label_placement'] ); ?>">
		<?php echo $args['html_before_fields']; ?><?php //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- designed to contain potentially unsafe HTML, set by developers. ?>
		<?php acf_render_fields( $fields, $post_id, $args['field_el'], $args['instruction_placement'] ); ?>
		<?php echo $args['html_after_fields']; ?><?php //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- designed to contain potentially unsafe HTML, set by developers. ?>
	</div>
	<?php if ( $args['form'] ) : ?>
		<div class="acf-form-submit">
			<?php printf( $args['html_submit_button'], $args['submit_value'] ); ?><?php //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- designed to contain potentially unsafe HTML, set by developers. ?>
			<?php echo $args['html_submit_spinner']; ?><?php //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- designed to contain potentially unsafe HTML, set by developers. ?>
		</div>
		</form>
	<?php endif;
}