Manual for template programmers

camindo CMS delivers content by means of templates, for example HTML on a website. CMS commands prepare the content and insert it dynamically into the template. Example of a greatly simplified page template:

<html>
<body>
<h1>(CMS:TEXT title)</h1>
<div>(CMS:TEXT text)</div>
<div>(CMS:MEDIA field=image attr[id]=image1)</div>
<div>created: (CMS:DATE created_at format="dd.MM.y")</div>
</body>
</html>

CMS commands are not merely placeholders. They represent complex encapsulated functionality that can be adapted with parameters and combined with one another. This saves a lot of development time. Moreover, they are proven and guarantee stability.

Examples of what CMS commands can do:

• determine content matching certain criteria from the database
• process content
• check, save or send user input
• registration of website visitors, sign-in and sign-out
• include further templates

Output formats: In addition to websites with HTML pages, further output media and publication channels are possible. Content can, for example, be formatted as XML files, PDF files, emails … and made available for retrieval via a URL, written as files to the file system, or pushed over a network.

Template set: Nobody needs to reinvent the wheel. Content areas (their configuration incl. input fields, optionally with content) and the associated templates can be exported in XML format. When imported into another camindo installation, the relations between areas and templates remain intact. The complete application part is immediately ready for use. This enables the easy integration of ready-made kits (forum, news feed, ...) or the export of self-developed applications for reuse in later projects.

Contents

1. Basics – how a page is created, addresses, syntax, lists, links, the concept “every record has a page”, filters, multilingualism, security headers (delivering CSS/JS/JSON, embedding in partner websites), scheduled templates, templates in the file system
2. Template sets – encapsulating functions, keeping them portable, passing them on and adapting them
3. Trigger templates – PHP methods for the events of the records of an area (saving, deleting …) and for the actions of the deletion policies
4. Command reference – one page per command (below)

How templates are organized in the back end and assigned to content areas is described in the Manual for administrators.

Command reference

(CMS:COMMAND value parameter=value parameter[key]="value" …)

Command names and parameter names are not case-sensitive. The first value without = counts as the main parameter of the command ((CMS:TEXT title) = (CMS:TEXT field=title)). Values in quotation marks may contain PHP expressions, as is customary in a PHP string ("{$set['x']}").

The output parameters are the same for most commands:
ifempty (replacement for an empty value),
instead (replacement for a non-empty value),
prefix / suffix (only for a non-empty value),
set (result is written to the variable $set[…] instead of to the page),
id (another record as the source),
replace (replace partial texts) for TEXT, DATE, DATETIME, TIME and NUMBER.

Output

Relations

Queries

Navigation

Control

Frontend editing

Community

The administrator sets up the community functions (see Manual for administrators).

PDF add-on module

The PDF add-on module (camindo/module-pdf) supplements the commands (CMS:PDF_…), with which templates create PDF documents – page by page, if desired on a PDF template such as letterhead paper, with texts, HTML, images, lines and tables:

(CMS:PDF_INIT margins=25,20,30,20)
(CMS:PDF_PAGE letterhead.pdf)
(CMS:PDF_FONT helvetica style=B size=16)
(CMS:PDF_TEXT "Invoice {$cms['number']}" y=50)
(CMS:PDF_PRINT invoice.pdf)

The complete command list is part of the documentation of the module.

1 Basics of template programming

What a template is

A template is a text document – usually HTML – that contains CMS commands. The commands query records, insert contents, include other templates, evaluate forms and control the flow. PHP code may also appear in between.

(CMS:INCLUDE header)
<h1>(CMS:TEXT title)</h1>
<div>(CMS:TEXT text)</div>
<div>(CMS:MEDIA field=image_small attr[id]=image1)</div>
<div>created: (CMS:DATE created_at format="MM/dd/y")</div>
(CMS:INCLUDE footer)

When you save, camindo CMS translates the template into PHP. At runtime only this PHP is executed – there is no template engine that evaluates the text again on every call.

How a page is created

When a visitor opens an address, camindo CMS determines:

1. the instance – from the domain,
2. the language – from the language code in the address, otherwise from the browser's language setting, otherwise the primary language,
3. the record – from the slug or the number (record_id) in the address; without one, the start record of the instance,
4. the template – from the address, from the record, or the default template of its content area.

The contents of the requested record are available in the template. By default, all output commands refer to this record – see (CMS:TEXT title) above. If the template runs a query with CMS:SELECT, the contents of the records found are available in the same way in the result template; see Lists, SELECT and the result loop below.

Addresses

[/{language}]/{slug or number}[,{template}]

Pure digit sequences are always record numbers; anything else is a slug. If the first part of the address is the slug prefix of a content area, the rest is searched only in this area; otherwise the whole path is searched in the areas without a prefix. The language code is part of the address as soon as the instance has more than one language. Generate addresses with CMS:URL – never by hand, then language, slug and domain always match.

If the address consists only of the language code (/en, without a trailing slash), camindo CMS redirects to the start page of the language (/en/ or /en_US/ – depending on how it is set up). If the site has only one language and a record has exactly this slug, the record is shown instead. Addresses for which there is nothing – unknown record, unknown language, template not released – respond with the status 404.

Syntax of CMS commands

(CMS:COMMAND value parameter=value parameter[key]="value" …)

• Command names and parameter names are not case-sensitive.
• Parameters are separated by spaces; a command may span several lines.
• The order in which a command processes its parameters is determined by the command itself, not by the order in which the parameters are written.
• The first value without = is the main parameter of the command: (CMS:TEXT title) is the same as (CMS:TEXT field=title).
• Values that contain spaces are enclosed in quotation marks, single or double: (CMS:TEXT field="title") is the same as (CMS:TEXT field='title').
• Subkeys in square brackets: filter[area]=news. Empty brackets append to a list: sort[]=date sort[]=title. If the same subkey is given several times, a list is created as well (in contrast to PHP array syntax, [] is optional).
• Instead of =, a comparison operator may stand between parameter and value – ==, !=, !, !!, <, >, <=, >=, <<, >>: filter[price] >= 100 is the same as filter[price]=">=100". The value then applies unchanged; an operator at its beginning is no longer evaluated: filter[code] < ">2" compares with the text “>2”. With = it stays as before – filter[code] = ">2" means “greater than 2” (see Filter syntax).
• The line break after a CMS command is swallowed, in the same way as after a <?php … ?> block.
• Command parameters in double quotation marks may contain PHP variables: attr[alt]="{$myvar}" (parameters without quotation marks are handled internally like parameters in double quotation marks).

Errors – an unknown command, an unknown parameter, a missing bracket – do not prevent saving. The detail view of the template shows them with the line number. They also appear on the start page in the widget “Template messages” – in case templates are edited through the file system.

Combining CMS commands and PHP code

$set <?php … ?> blocks may appear freely in the template, but CMS commands inside PHP blocks lead to errors! To use the contents of CMS commands in PHP blocks, use the parameter set (for example set = myvar) and read the content in the PHP block from $set ($set['myvar']).

$cms The contents of the requested record are in $cms; so are the contents of records found with CMS:SELECT.

For output, always use the CMS output commands (such as CMS:TEXT). These commands take care of correct formatting; a <?php echo $cms[…] ?> does none of this. Use $cms only where a command needs a value as a parameter, for example filter[category]="{$cms['record_id']}".

Common parameters of the output commands

(CMS:TEXT subtitle prefix="<h2>" suffix="</h2>")
(CMS:NUMBER price format="%.2f" suffix=" $" ifempty="on request")

Values in attributes and JavaScript

camindo CMS removes script, event handlers (onclick …), iframe, object, embed and javascript: links from all record contents – when saving and again when outputting. HTML formatting remains, which is why CMS:TEXT outputs contents unescaped.

If you insert a value into an HTML attribute, escape it with specialchars=true – otherwise a quotation mark in the content would end the attribute:

<img src="…" alt="(CMS:TEXT title specialchars=true)">
<a href="(CMS:URL)" title="(CMS:TEXT teaser specialchars=true striptags=true lbrconvert=false)">…</a>

The same applies to form input that you put back into the field after submitting:

<input name="data[nickname]" value="(CMS:TEXT useval="{$_POST['data']['nickname']}" specialchars=true)">

Commands that escape themselves: Some commands already escape their output with htmlspecialchars. For them, specialchars is omitted – an already escaped value would be escaped a second time, and an & would appear as &:

What you pass to one of these commands must therefore be unescaped text – without HTML tags and entities:

(CMS:TEXT title striptags=true ampconvert=false lbrconvert=false set=title)
(CMS:MEDIA image attr[alt]="{$set['title']}")

Never escaped are prefix, suffix, ifempty and instead – they come from the template and may contain HTML. Only CMS:TEXT and CMS:SNIPPET know specialchars. Values of other commands, such as CMS:MEDIA … subfield=filename, CMS:RELATION or CMS:RAW, store them with set for an attribute and output them escaped via CMS:TEXT:

(CMS:MEDIA document subfield=filename set=filename)
<a href="(CMS:MEDIA document subfield=path)" title="(CMS:TEXT useval="{$set['filename']}" specialchars=true lbrconvert=false)">…</a>

CMS:URL and CMS:MEDIA … subfield=path produce only URL-safe characters, and so does CMS:TEXT … urlencode=true – they can stand in href and src without escaping.

If JavaScript needs a value, output it as a data- attribute and read it there – so that no content ever appears in the script code itself:

<div id="product" data-title="(CMS:TEXT title specialchars=true)"></div>
<script>var title = document.getElementById('product').dataset.title;</script>

Lists, SELECT and the result loop

Lists always consist of two templates: the calling template queries with CMS:SELECT and names a list template. The list template runs through the hits between CMS:RESULT_START and CMS:RESULT_END.

Calling template:

<h2>Latest news</h2>
(CMS:SELECT news_list
  filter[area]=news
  sort=date
  order=desc
  limit=10
  noresult="<p>No news.</p>"
)

List template news_list:

<ul>
(CMS:RESULT_START)
  <li><a href="(CMS:URL)">(CMS:TEXT title)</a> – (CMS:DATE date)</li>
(CMS:RESULT_END)
</ul>

Inside the loop, the current row is the running record. A list template may itself contain CMS:SELECT – for example the tags of each article.

Paging: count=true counts all hits; CMS:JUMP_LIST, CMS:JUMP_PREV and CMS:JUMP_NEXT turn this into the navigation.

Publication: Templates find only published records – released, publication date reached, expiry date not yet reached. The parameters future and archive relax this per query, for example for an archive or a preview of upcoming events.

The parameter state is intended exclusively for views inside the back end.

Addressing areas

Content areas are addressed by their name or by their number (area_id): filter[area]=news, filter[area]=12 or filter[area_id]=12. Separate several areas with commas. Because field names are uniform across the system, several areas can be filtered and sorted together:

(CMS:SELECT timeline
  filter[area]=news,events,blog
  filter[date] >= 2026-01-01
  sort=date
  order=desc
)

sort=area sorts by area; _default stands in filters and sorting for the main field of each area, whatever it is called there.

Overview page of an area

The address consisting only of the slug prefix (/events) calls the overview template of the area – without a record. In its place stand the details of the area:

In this way, an overview template lists the records of its area without having their name written in it – and can be used for several areas:

<h1>(CMS:TEXT area_label specialchars=true)</h1>
(CMS:SELECT event_list
  filter[area]="{$cms['area_id']}"
  sort=date order=asc
)

Linked records

With relation, CMS:SELECT retrieves the records that are linked with the current record (or with the record named in src_id) via a link field.

(CMS:SELECT gallery_list
  relation=see_also
  sort="created_at desc"
)

With sort="_custom asc", linked records appear in the order that the editorial team set in the lookup field (using the arrow buttons):

(CMS:SELECT gallery_list
  relation=images
  sort="_custom asc"
)

To sort and filter by fields of linked records, use dot notation: sort=author.last_name.

If there is no current record and src_id is not given or invalid, the search with the parameter relation finds nothing.

The concept: every record has its own page

In camindo CMS, every record has its own page in the frontend – not only articles and products, but also every category, every tag, every material. A website therefore needs no parameters such as ?cat=12 or ?tag=oak:

1. Linking: Lists link every record with CMS:URL – the category just as the product.
2. Default template per area: Each content area gets a default template – a category page, a tag page, a product page. With a slug prefix, each kind of page gets its own address space (/en/category/living, /en/tag/oak).
3. Listing linked contents: On the page, the record is in $cms; the template queries its linked records directly through it.

Category page (default template of the area categories):

<h1>(CMS:TEXT title)</h1>
(CMS:TEXT text prefix="<p>" suffix="</p>")
(CMS:SELECT product_list
  relation=rel_products
  sort=position
  order=asc
)

List template product_list – the products link back to their own page:

<ul>
(CMS:RESULT_START)
  <li><a href="(CMS:URL)">(CMS:TEXT title)</a></li>
(CMS:RESULT_END)
</ul>

Navigation is just as simple – a list of all categories with links:

(CMS:RESULT_START)
<a href="(CMS:URL)">(CMS:TEXT title)</a>
(CMS:RESULT_END)

Which query returns the linked records depends on from which page the link starts:

Relation fields (relation, relation1) are linked in both directions: when you create them, camindo CMS creates in the target area a counterpart field named rel_{areaname} (for example rel_products), which leads the link from the other side. The category page therefore queries its products with relation=rel_products, and the product page queries its categories with relation=categories.

Pointer fields (pointer, pointer1) are directed – they can point to several areas. The target record does not know its pointers; the counterpart is a filter on the pointer field with the number of the current record:

(CMS:SELECT product_list
  filter[area]=products
  filter[category]="{$cms['record_id']}"
)

Note: The number of the current record is in $cms['record_id'] – there is no key id. An empty filter value cancels the filter: filter[category]="{$cms['id']}" therefore does not find no products, but all products.

Searches and free filter combinations remain parameters (?q=…), because they are not records. Everything that is a record, on the other hand, has its own address – and with it its page title, description and frontend editing like any other page.

Filter syntax

The values in filter[…] follow the same syntax as the search mask in the back end:

The operator may also stand between key and value – handy when the value comes from a variable:

(CMS:SELECT embargo_mail
  filter[area] = press_releases
  filter[online_at] > {$set['last_run']}
  filter[online_at] <= {$set['this_run']}
  filter_mode[online_at] = AND
  future = true
)

is the same as filter[online_at]=">{$set['last_run']}" and filter[online_at]="<={$set['this_run']}". With such an operator, the value itself is free of operators: if the content of the variable begins with <, > or !, it is compared as text.

A date value that cannot be evaluated (such as a Unix timestamp like $_SERVER['REQUEST_TIME']) is skipped without a message – the list then shows all records, as if the filter were not there. For analyses in your development environment, debug=true helps: the generated SQL query is displayed.

Text comparisons by language: Text and character fields (including _default) are compared and sorted according to the rules of the language version in which you search – derived from the language code, nothing needs to be set. Always valid: no distinction between upper and lower case and accents (cafe finds “Café”), ß equals ss. In addition, the rules of individual languages apply:

Bulgarian, Esperanto, Estonian, Galician, Icelandic, Croatian and Bosnian, Latvian, Lithuanian, Polish, Romanian, Russian, Serbian (Latin), Slovak, Slovenian, Spanish, Czech, Hungarian and Vietnamese have rules of their own as well. All other languages – English included – follow the general rules.

This applies equally to =, wildcards and comparisons such as >, and to full-text fields (Mueller finds “Müller”, Muller does not). In the back end, the language that is set for the instance of the searched area applies; if the instances of one search follow different rules, only the general rules apply.

Different filters are always combined with AND. Full-text fields understand +must -mustnot; encrypted fields only the exact value.

In areas with a tree structure, filter[parent_id]=42 returns all descendants of record 42; together with filter[depth]=1 only the direct children – the basis for navigations.

Including and organizing templates

CMS:INCLUDE includes another template – for example the header and footer of the page:

(CMS:INCLUDE layout.header)
<main>…</main>
(CMS:INCLUDE layout.footer)

Template names only have to be unique within their template area. If a name exists in several areas, refer to it as areaname.templatename. A name that is not unique is reported by the page as an error.

Typical division:

Caching

Expensive building blocks – a navigation made of many queries, a product list – can be cached by CMS:INCLUDE with caching: (CMS:INCLUDE layout.navigation caching=1h) creates the navigation at most once an hour per website and language. What else the output depends on belongs in cacheparams – see CMS:INCLUDE.

Multilingualism

A template automatically outputs the language version of the call – if a translation is missing, the primary language. Links with CMS:URL keep the language; with the parameter lang, you link explicitly to another language version. To build a language switcher, use CMS:SELECT_LANGVERSION.

Date and number formats follow the language version; so does the time zone.

Fixed labels (“Read more”, “Search”) are maintained by the editorial team as separate records (for example in an area named “Other texts”) in all frontend languages. This area should have a single-language slug field and a multilingual text field. Then CMS:TEXT works as a snippet provider; see CMS:TEXT with the id parameter.

<a href="(CMS:URL)">(CMS:TEXT id=labels.readmore)</a>

Frontend editing

CMS:FED places an edit marker on a content that only users with frontend editing switched on can see. A click opens the input form of the record in the back end. CMS:FED_CODE outputs HTML only in this case – for example a stylesheet for the markers.

Security headers: CSS, JavaScript, JSON and embedding

camindo CMS sends a few HTTP headers before each template, which the browser applies as protection:

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
Referrer-Policy: strict-origin-when-cross-origin

For ordinary HTML pages you do not need to do anything. Two cases do have an effect – and the cause is not obvious at first glance:

Templates that deliver CSS, JavaScript or JSON

A template is delivered as text/html unless it says otherwise. Because of nosniff, the browser then does not accept the content as a stylesheet or script, even if it is correct. The page looks unstyled, the script does not run – and the browser console reports something like “refused to execute script … MIME type ('text/html') is not executable” or “… not a supported stylesheet MIME type”.

Therefore set the appropriate type at the beginning of each such template – before any output, without a blank line in front:

(CMS:HEADER "Content-Type: text/css; charset=utf-8")
(CMS:HEADER "Content-Type: text/javascript; charset=utf-8")
(CMS:HEADER "Content-Type: application/json; charset=utf-8")

Embedding output in other websites

A page of the website can only be shown in an <iframe> within the same website. This protects sign-in, profile and shopping cart from a foreign page overlaying them invisibly and slipping clicks to visitors (clickjacking). If a partner website embeds a page via <iframe>, the frame therefore stays empty or shows an error page of the browser; the console reports “Refused to frame … because an ancestor violates … frame-ancestors” or “… X-Frame-Options to 'sameorigin'”.

If a template should be allowed to be embedded – a widget, an event calendar for partners – release it only in this template: remove X-Frame-Options by giving it no value, and name the permitted websites in frame-ancestors:

(CMS:HEADER "X-Frame-Options:")
(CMS:HEADER "Content-Security-Policy: frame-ancestors 'self' https://www.partner.example https://*.partner.example")

Both lines belong together: a browser that still sees X-Frame-Options refuses the frame despite frame-ancestors. Name the partners individually – frame-ancestors * allows every website to embed the page – including the pages with forms. Other kinds of embedding are not affected: images, downloads, data loaded by JavaScript (JSON) and links to your website work without release.

More on the header lines: CMS:HEADER.

Templates in the file system

Each template is stored as a file at var/templates/{instance_id}/{area_name}/{template_name}.cms.php. You can edit it there with a code editor and manage it with Git. camindo CMS applies changes every minute (or immediately via “Refresh” in the module Templates) and recompiles the template. Rename templates in the back end – in the file system, a rename counts as deleting and creating anew, and the assignments are lost. Error messages appear in the widget “Template messages”.

Editor support

For Visual Studio Code there is the extension “camindo CMS Templates” (github.com/dirkintelligence/camindo-vscode, also in the Visual Studio Marketplace and on Open VSX). In *.cms.php files it colors the CMS commands purple and the PHP expressions inside them orange – like the view in the backend –, completes the command names after (CMS: and then the parameters of the command, and shows their description on hover, in the same language as the backend.

The extension knows the commands of the core and the standard modules. If your modules bring their own commands, write the command list of your project with

php Core/cron/camindo.php template commands --all --out=var/vscode

and enter the directory in the VS Code setting camindo.commandsFile.

Scheduled templates

A template with the usage “Scheduled (scheduler)” (tab “Access” of the template) does not run as a page, but as a task of the scheduler (task type “Template”; see Handbook for administrators). It can never be reached via an address.

It runs like a page call without a record: in the website of its template area, in the language that the task names – with its texts, snippets, date formats and time zone. There is no visitor, hence no sign-in and no shopping cart. The task passes the time window since the last successful run:

On the first run, the time window is empty. If a run fails, the next one catches up on the whole period – nothing is lost and nothing is processed twice. The time window fits directly into a filter; two conditions for the same field are combined with AND via filter_mode:

(CMS:SELECT embargo_mail
  filter[area]=press_releases
  filter[online_at] > {$set['last_run']}
  filter[online_at] <= {$set['this_run']}
  filter_mode[online_at]=AND
  future=true
)

The result template then sends, for example with CMS:EMAIL (submit=1), one message per hit; CMS:URL with absolute=true returns the complete address for links. If a command reports an error, the run counts as failed. On request, the task saves what the template outputs under var/custom/ – this is how a sitemap or a feed is created as a file.

Preview

The preview from the back end also shows unpublished records with their template. Lists in it still show only published records, as do id=… and CMS:RELATION. In the preview, $this->isPreview() returns true.

List templates for the back end

A content area can have a list template that is used only in the back end: for an additional column of the record list and for the detailed preview in lookup fields. In the template, the record of the row is available as $cms; the output commands CMS:TEXT, CMS:MEDIA … work as in the frontend:

(CMS:MEDIA image_small width=60)
<small>(CMS:NUMBER price format="%.2f" suffix=" $")</small>

CMS:RELATION is helpful here to list the main field of linked records.

2 Template sets

Encapsulated functionality

A template set bundles one function of the website: templates, content areas, possibly records and snippets. Examples:

A good template set is ready to use right away: import it, enter contents, done. And it is adaptable to the individual structure of a website without the function having to be developed anew. It is passed on by XML export with the option “Optimize templates for import into a foreign database” (see Handbook for administrators).

Rules for portable template sets

One folder, one template area

Place the content areas and the template area of a set together in one folder. In this way, one click exports the whole set, and on import it is clear what belongs together.

Names and IDs directly in the command parameter

Templates, content areas and records are addressed in the templates by their ID or their name (or slug). In a foreign database these may already be taken; then the importer assigns new ones and adjusts the templates accordingly. The adjustment succeeds only if IDs, names and slugs stand directly in the command parameters. If a parameter contains a PHP variable that receives its value only at runtime, the adjustment fails.

Consistent field names

For your own template sets: use the same field names as in the rest of the website (title, date, text, image, slug). Then cross-area lists – for example a timeline of news and events – work without adjustment, and a template set can easily be combined with existing areas.

For template sets in other databases: use the name prefixes, so that the import does not produce type conflicts (see Reserved name prefixes).

Separate logic and design

Keep the logic (queries, filters, paging, form evaluation) together in a few templates, and the design in separate, small building blocks:

news_overview     (CMS:SELECT news_list filter[area]=news … count=true)
news_list         (CMS:RESULT_START) (CMS:INCLUDE news_teaser) (CMS:RESULT_END)
                  (CMS:JUMP_LIST …)
news_teaser       <article class="teaser"> … (CMS:TEXT title) … </article>

Whoever adapts the set to a different design changes only news_teaser and the other design building blocks; the function remains untouched.

Including the website layout

Use fixed header and footer templates; these can easily be replaced by existing ones.

Texts in a separate content area

Fixed labels (“Read more”, “Back to overview”, error messages from forms) belong in a separate content area (for example “Labels”). They are included with CMS:TEXT, for example (CMS:TEXT id=labels.readmore). In this way they can easily be adapted and translated for the later website.

Labels as custom snippets

To keep area names and input field labels multilingual as well, custom snippets can be created (see Snippets module). The snippets used in the template set are automatically included in the export file.

Settings as a record

If the editorial team is to control the behavior of a set – number of entries per page, title of the overview page, an introductory text – create for this a small content area “Settings” with a single record and read it via its slug:

(CMS:TEXT intro id=news-settings)
(CMS:NUMBER entries_per_page id=news-settings set=limit)
(CMS:SELECT news_list filter[area]=news limit="{$set['limit']}" count=true)

Shipping sample content

A few sample records show right after the import how the set looks and works. Export them along with their images.

Documenting

Add a short description to the set – as a note in the folder or as a record: which templates are to be assigned as default templates, which layout templates are expected, which snippets and converters the set uses.

CSS as a template

Include the required CSS as a template – in this way the template set appears immediately in the intended design. The user can move the CSS into a file at any time. Note, however, that this template needs special header instructions; see Templates that deliver CSS, JavaScript or JSON.

Using a template set

1. Import (module “Contents” on the start page → menu ⋮ above the record list → “Import”), preferably first in a test environment.
2. Test with the preview – in particular links that the import log reports as “not assigned”.
3. Adjust the header and footer, or replace them with your own.
4. If the template set is a whole website: enter the start page ID or start page template in the instance.
5. Clarify legal aspects; adjust texts and deletion policies if necessary.

3 Trigger templates

A trigger template contains PHP methods that camindo CMS calls on events of the records of a content area – when creating, saving, deleting, restoring, and for the actions of a deletion policy. In this way, contents can be prepared on saving (combine several fields into one, check values), linked data can be updated, or personal data can be anonymized according to your own rules.

The methods run regardless of where the change comes from: input form, frontend (CMS:SAVEDATA, CMS:USER_…), API, import, batch processing, the trash cleanup job, and deletion policies.

Assignment

A trigger template is an ordinary template in a template area. You assign it in the settings of the content area under “Trigger templates” (see Handbook for administrators). An area can have several trigger templates, and the same template may be assigned to several areas. In this way, reusable building blocks can be formed – for example a template that maintains slugs in all areas, and alongside it one with the rules of a single area.

Order

The templates of an area run one after another in the displayed order for each event; you change the order with the arrow buttons arrow_upward arrow_downward next to each entry.

• A template without the method of the event is skipped.
• All of them receive the same variables: what one template changes in $data or $affectedFields, the next one already sees.
• If a template throws an exception, the following ones no longer run, and the process is cancelled (see Cancelling).
• Each template is an object of its own: properties and helper methods with the same name in different templates do not interfere with each other. Exchange data between templates via $data.

Structure

The template contains method definitions only – no output, no statements outside the methods. camindo CMS places the compiled code into the body of a class; each method thus becomes a method of an object:

<?php
// Trigger template "members_trigger" for the area Members

function onSave(array &$affectedFields, array &$data, array &$previousData): void
{
    // Display name from first and last name
    $data['name'] = trim(($data['first_name'] ?? '') . ' ' . ($data['last_name'] ?? ''));
    if (!in_array('name', $affectedFields, true)) $affectedFields[] = 'name';
}

private function normalize(string $text): string
{
    return trim(preg_replace('/\s+/', ' ', $text));
}

• All event methods are optional. If one is missing, nothing happens for that event.
• Your own helper methods (private function …), properties and constants are allowed.
• CMS:SELECT is allowed to determine contents of linked records (note the remarks below!).
• Address classes by their full name (\Camindo\Core\Cms, \DateTimeImmutable) – use does not work, because the code sits in the middle of a class.
• A template that cannot be loaded (syntax error, output outside the methods) aborts the process with an error message. Saving records without the intended processing would be worse.

What is available in the template

Events

$previousData is the saved state before the change (empty for a new record).

Cancelling

All events except onCreate and onLoaded run in the transaction of the process. An exception cancels it and reverts it completely; the message appears in the input form or as an error of the API:

function onSave(array &$affectedFields, array &$data, array &$previousData): void
{
    if (($data['end'] ?? '') !== '' && $data['end'] < ($data['start'] ?? '')) {
        throw new \Exception('The end is before the start.');
    }
}

Temporary saving

If an editor switches tabs in the input form, camindo CMS saves the interim state of the working copy – onSave and onSaved also run then, with $this->temporary = true. Time-consuming or outward-facing steps (emails, interfaces) belong after if ($this->temporary) return;.

Moving

If a record is moved to another area, the trigger templates of the target area apply. $data already contains the fields of the target area there, $previousData the state in the source area with its field names.

Re-entry

If a template saves the same record again in onSaved(), it would run endlessly. An event is therefore not nested for the same record within the same template: when saving again, the other trigger templates of the area run, but the one currently running does not. Other records – also of the same area – trigger their triggers normally.

Querying linked contents

The contents of the triggering record are in $data (new state) and $previousData (previous state) – multilingual fields with all languages. Read and change them there, not via CMS:TEXT.

For other records, such as the linked ones, you can use CMS:SELECT as in any template. While a method runs, $cms contains only record_id, the number of the triggering record. A CMS:SELECT with relation therefore needs no src_id – and should not have one (see below):

function onSave(array &$affectedFields, array &$data, array &$previousData): void
{
    $isVariant = false;
?>
(CMS:SELECT
  relation=variant_of
  state=any archive=true future=true
  resulttemplate=shop.trigger_variant_found
)
<?php
    $data['is_variant'] = $isVariant ? 'yes' : '';
    if (!in_array('is_variant', $affectedFields, true)) $affectedFields[] = 'is_variant';
}

The result template (shop.trigger_variant_found) runs in the body of the method: it sees the variables of the method and $this, and here only sets $isVariant = true;. It must not output anything.

Observe the limits:

• New state of the links via $cms['record_id']. While an existing record is being edited, its links – outgoing as well as incoming – hang on a working copy; only after saving do they pass over to the record. In onSave() – and in onSaved() during temporary saving – $cms['record_id'] therefore contains the number of the working copy: CMS:SELECT relation=… and CMS:RELATION without a source specification already see the changed links, and so does the reverse direction (“Who refers to this record?”) with dest_id="{$cms['record_id']}" or filter[field]="{$cms['record_id']}". $data['record_id'], on the other hand, is always the number of the record itself – with it you get the previous state in onSave(). In onSaved() after the final saving, and in all other methods, both numbers are the same.

• Embedded contents during temporary saving: Links of a field with embedded contents point, during temporary saving, to their working copies, which CMS:SELECT does not find. On final saving these contents are already taken over and are found.

• Publication: CMS:SELECT finds here only what the website would show – released, publication date reached, not expired. If the question concerns the structure (“Is any record linked at all?”), set state=any archive=true future=true; otherwise blocked, pre-dated and expired records are missing. CMS:SELECT never finds records in the trash.

• Rights: The query sees what the triggering user may see. The result can therefore differ depending on who saves:

  Trigger	What CMS:SELECT finds
  User in the back end or via the API	only contents of the instances, areas and languages that their user group may read (superusers: all)
  Website (CMS:SAVEDATA, CMS:USER_…)	contents of the instance and its readable instances
  Scheduler (also due blocks of a deletion policy later on)	all

• Language: Multilingual fields of the records found appear in one language – on the website in the language of the page, in the back end in the content language of the user. All languages are returned by $this->record->load($id).

onPrivacyAction: deletion policies

A deletion policy determines what happens when a record is deleted. What cannot be expressed with “Overwrite individual fields” – linked records, texts that are only partly personal, multilingual contents per language – is handled by the trigger template with two actions:

Each such block has an identifier (lowercase letters, digits, _). It arrives as $action – the template uses it to tell the blocks apart, for example an immediate step from one after a year.

function onPrivacyAction(string $action, array &$data, array $context): void

On the record

$data contains all fields of the record – multilingual fields as an array language_id => value, file fields with their metadata. camindo CMS then saves what the method changes in $data:

• in policy mode: without required-field and format checks and without the rights of the user group – “unique” still applies;
• not file fields, record_id, area_id, user_id and the other identifiers. To remove a file, use “Overwrite individual fields” (image = "") in the same or a later block;
• in the audit log as the action “adjusted by deletion policy” (privacy), without the previous values.

If the record lies in the trash ($context['deleted']), the method runs as well – for example to tidy up linked data – but nothing is saved on the record then. Other records the method processes itself via $this->record or $this->db.

On the audit log

For each entry in the history of the record, the method is called with the entry:

camindo CMS writes changed entries back – into the file under var/audit/ with a new checkpoint of the checksum chain, and label also into the database. Entries that arise only later (for example during permanent deletion) do not pass through the method; plan a later block for them.

If the area has several trigger templates with onPrivacyAction(), they run one after another with the same identifier; each checks itself whether $action concerns it.

Errors

If none of the trigger templates of the area has onPrivacyAction(), or if the method throws an exception, the job fails: it appears in the log privacy with the message and is retried at the next run of the scheduler task “Apply deletion policies” – at most 20 times. If a block that is due immediately fails, the deletion does not abort: the remaining blocks run, and the failed one follows with the next run.

CMS:DATE

Outputs the date part of a date value, formatted.

(CMS:DATE field [parameter=value …])

Method: Cms::cmsDate()
Without key: the first value without = is the field
At least one of: field, useval

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Outputs the date part of a date/time value. The source is a date or date-time field (meta fields online_at, created_at, changed_at or your own fields). Without format, the language of the page determines the notation:

(CMS:DATE online_at)                            07.03.2024   (de)
(CMS:DATE online_at format="EEEE, d MMMM y")    Thursday, 7 March 2024
(CMS:DATE online_at format="y-MM-dd")           2024-03-07

Typical in lists:

<time datetime="(CMS:DATE online_at format='y-MM-dd')">(CMS:DATE online_at)</time>

CMS:DATE, CMS:DATETIME and CMS:TIME are the same command with a different section; all three know the same parameters (CMS:DATETIME additionally autotime).

Parameters in detail

id

id reads from another record instead of the current one – record_id or slug, exactly as in the URL:

(CMS:DATE online_at id=1977)
(CMS:DATE online_at id=imprint)

field

field is the main parameter and may be given without a key – both lines are the same:

(CMS:DATE field=online_at)
(CMS:DATE online_at)

useval

Instead of a field, useval takes a value directly from the template – usually a PHP variable or a value stored earlier with set:

(CMS:DATE useval="2024-12-24")
(CMS:DATE useval="{$set['value']}")

(CMS:DATE useval="{$set['user']['created_at']}")

format

format is an ICU pattern (d day, MM month with two digits, MMMM month name, y year, HH:mm time, EEEE weekday). Without format, the language of the page decides (in the back end, the locale of the user):

(CMS:DATE online_at format="d MMMM y")

Output: 7 March 2024

timezone

(CMS:DATE online_at timezone=true)

Output: 07.03.2024 Europe/Berlin

replace

replace replaces parts of text in the already formatted value – short form with ? as separator, or one entry per search text:

(CMS:DATE online_at format="MMM y" replace="Jan.?January")
(CMS:DATE online_at format="MMM y" replace[Jan.]="January" replace[x]="y")

Output: January 2026 instead of Jan. 2026

ifempty

ifempty replaces the entire output if the source is empty; prefix and suffix are then omitted:

(CMS:DATE offline_at prefix="<p>" suffix="</p>" ifempty="unlimited")

The placeholders for “no date” and “no end” that camindo CMS stores for an unlimited offline_at (before 2 January 1000 or from 31 December 8999) also count as empty – with and without format.

instead

instead replaces the value as soon as the source is not empty – useful if only the presence matters:

(CMS:DATE offline_at instead="limited" ifempty="-")

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty published on:

(CMS:DATE online_at prefix="published on " suffix="")

suffix

(CMS:DATE online_at suffix=" (first publication)")

See prefix.

set

set outputs nothing, but stores the result under $set['date'] for the surrounding PHP or a later command:

(CMS:DATE online_at set=date)
<?php if ($set['date'] !== '') { ?> … <?php echo $set['date']; ?> … <?php } ?>

← Overview

CMS:DATETIME

Outputs date and time of a date value, formatted.

(CMS:DATETIME field [parameter=value …])

Method: Cms::cmsDatetime()
Without key: the first value without = is the field
At least one of: field, useval

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Outputs date and time. Like CMS:DATE, but with the time part:

(CMS:DATETIME changed_at)                               07.03.2024, 14:30
(CMS:DATETIME changed_at format="dd.MM.y HH:mm")        07.03.2024 14:30
(CMS:DATETIME changed_at format="dd.MM.y HH:mm" autotime=true)

With autotime=true, the time disappears if none was set in the value (00:00:00) – for appointments that last “all day”.

Parameters in detail

id

id reads from another record instead of the current one – record_id or slug, exactly as in the URL:

(CMS:DATETIME changed_at id=1977)
(CMS:DATETIME changed_at id=imprint)

field

field is the main parameter and may be given without a key – both lines are the same:

(CMS:DATETIME field=changed_at)
(CMS:DATETIME changed_at)

useval

Instead of a field, useval takes a value directly from the template – usually a PHP variable or a value stored earlier with set:

(CMS:DATETIME useval="2024-03-07 14:30:00")
(CMS:DATETIME useval="{$set['value']}")

format

format is an ICU pattern (d day, MM month with two digits, MMMM month name, y year, HH:mm time, EEEE weekday). Without format, the language of the page decides (in the back end, the locale of the user):

(CMS:DATETIME online_at format="dd.MM.y HH:mm")

Output: 07.03.2024 14:30

autotime

Only together with format: if the value contains no time (00:00:00), the time part is removed from the output:

(CMS:DATETIME event_at format="dd.MM.y HH:mm" autotime=true)

Output for 2024-03-07 00:00:00: 07.03.2024 – for 2024-03-07 14:30:00: 07.03.2024 14:30

timezone

timezone=true appends the name of the time zone in which the value is displayed:

(CMS:DATETIME online_at timezone=true)

Output: 07.03.2024, 14:30 Europe/Berlin

replace

replace replaces parts of text in the already formatted value – short form with ? as separator, or one entry per search text:

(CMS:DATETIME changed_at replace=", ? at ")
(CMS:DATETIME changed_at replace[, ]=" at " replace[x]="y")

Output: 07.03.2024 at 14:30

ifempty

ifempty replaces the entire output if the source is empty; prefix and suffix are then omitted:

(CMS:DATETIME event_at prefix="<p>" suffix="</p>" ifempty="Date to follow")

The placeholders for “no date” and “no end” that camindo CMS stores for an unlimited offline_at (before 2 January 1000 or from 31 December 8999) also count as empty – with and without format.

instead

instead replaces the value as soon as the source is not empty – useful if only the presence matters:

(CMS:DATETIME event_at instead="Date confirmed" ifempty="-")

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty Updated::

(CMS:DATETIME changed_at prefix="Updated: " suffix="")

suffix

(CMS:DATETIME changed_at suffix=" o'clock")

See prefix.

set

set outputs nothing, but stores the result under $set['changed'] for the surrounding PHP or a later command:

(CMS:DATETIME changed_at set=changed)
<?php if ($set['changed'] !== '') { ?> … <?php echo $set['changed']; ?> … <?php } ?>

← Overview

CMS:EMAIL

Sends an email. On request, checks the required fields of a form in advance.

(CMS:EMAIL [parameter=value …])

Method: Email::cmsEmail()
At least one of: subject, subjecttemplate, body, bodytemplate
PHP snippet: include_and_stop (after)

Parameters

² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Contact form with a required-field check and confirmation page:

<?php $submit = $_POST['submit'] ?? ''; ?>
(CMS:EMAIL
  submit="$submit"
  to="info@example.com"
  fromname="Contact form"
  subject="Contact request"
  bodytemplate=contact_mail
  requiredfields="name,email,message"
  successtemplate=contact_thanks
)
(CMS:MESSAGE prefix="<div class=alert>" suffix="</div>")
<form method="post">
  <input name="data[name]"> <input name="data[email]" type="email">
  <textarea name="data[message]"></textarea>
  <button name="submit" value="1">Send</button>
</form>

The process:

1. On the first call, submit is empty – the command does nothing, the form appears.
2. After submission, it checks the required fields. If one is missing, nothing is sent; CMS:MESSAGE shows the message, and the template continues – the form appears again.
3. Otherwise it builds the email, sends it and includes successtemplate. The page ends afterwards. Without successtemplate, the template simply continues to run.

Sending is done via the SMTP mailbox entered in the configuration (email.smtp), or alternatively via the PHP function mail() – like all emails of the CMS. If sending fails, the reason is stored in var/log/{date}_mail.log (module Log files, type “Undelivered emails”).

What the command leaves behind

<input name="data[email]" class="<?php echo in_array('email', $set['email_missing'] ?? []) ? 'error' : ''; ?>">

Messages

Errors end up in CMS:MESSAGE. message[index] determines the text, otherwise the default text applies:

The default texts appear in the language of the page.

Security

• Never take the recipient from the form. If an address in to is an input of the visitor, anyone can send emails to arbitrary addresses through your form. If one of the addresses in to is invalid, the command does not send at all.
• Throttle contact forms: throttle=true limits the emails per visitor, formguard=true (with (CMS:USER_TOKEN formguard=true) in the form) keeps robots at bay: (CMS:EMAIL submit="$submit" to="info@example.com" … throttle=true formguard=true). Order confirmations and other emails whose recipient you determine yourself do not need this.
• Sender: The sender is always the website operator, never the visitor: many mail servers accept only emails whose sender matches their own domain. It is therefore better to put the visitor's address into the text than into from; without from, the sender address from the configuration applies.
• Line breaks in subject, names and addresses are removed – injected headers (for example an additional Bcc:) are thereby excluded.
• HTML emails: output the visitor's input in the body template with (CMS:TEXT useval="{$_POST['data']['…']}" specialchars=true).
• Attachments only from var/download/, var/upload/ and var/modules/ – configuration, logs and backups cannot be attached.

Parameters in detail

to

(CMS:EMAIL to="info@example.com" …)
(CMS:EMAIL to[]="info@example.com" to[]="sales@example.com" …)

toname

Applies only if exactly one recipient is specified:

(CMS:EMAIL to="info@example.com" toname="Example Ltd." …)

from

(CMS:EMAIL from="shop@example.com" …)

Without specification, the sender address from the configuration (email.noreply, alternatively email.reply). If none of these is entered, nothing can be sent without from.

fromname

(CMS:EMAIL fromname="Contact form Example Ltd." …)

contenttype

(CMS:EMAIL contenttype="text/html" bodytemplate=newsletter_html …)

With text/html, the CMS additionally creates a plain-text version for email programs without HTML display.

subject

(CMS:EMAIL subject="Contact request" …)

subjecttemplate

Creates the subject from a template (e.g. with fields of the current record). Tags, entities and line breaks are removed:

(CMS:EMAIL subjecttemplate=order_subject …)

body

(CMS:EMAIL body="New request from {$_POST['data']['name']}" …)

bodytemplate

Message text from a template – there all CMS commands are available, the current record, $set and the form data in $_POST. Variables that you have set with PHP in the calling template are not visible to the body template; store them in $set if necessary.

(CMS:EMAIL contenttype="text/html" bodytemplate=contact_mail …)

contact_mail:

<p>New request from (CMS:TEXT useval="{$_POST['data']['name']}" specialchars=true)
(CMS:TEXT useval="{$_POST['data']['email']}" specialchars=true):</p>
<p>(CMS:TEXT useval="{$_POST['data']['message']}" specialchars=true)</p>

specialchars=true belongs with HTML emails. In a plain-text email (text/plain, default), visitor text cannot execute anything; specialchars would only make entities such as & visible there.

Template names can be specified with the area as with CMS:INCLUDE (area.name).

paths_absolute

Makes server-relative paths (/media/…) in src, href, action, background, poster and url(…) of the HTML body absolute:

(CMS:EMAIL contenttype="text/html" bodytemplate=newsletter_html paths_absolute=true …)

sender_url

Domain for paths_absolute, if the protocol and main domain of the instance should not apply; without a protocol, that of the instance applies:

(CMS:EMAIL paths_absolute=true sender_url="https://www.example.com" …)

debug

Writes the email only to the log file var/log/{date}_mail-debug.log, without sending it – for testing a form. Otherwise the command behaves as with real sending (required fields, successtemplate):

(CMS:EMAIL debug=true …)

requiredfields

Required fields in the request array data[…] (or the array named via data); if one is missing, nothing is sent and CMS:MESSAGE shows the message. For fields with several values (checkbox group data[topics][]), one selected value is sufficient:

(CMS:EMAIL requiredfields="name,email,message" …)

data

Name of the request array with the form data (default data, i.e. $_POST['data']):

<input name="form[name]">
(CMS:EMAIL data=form requiredfields="name" …)

submit

The command runs only if submit has a value – so not on the first call of the form:

<?php $submit = $_POST['submit'] ?? ''; ?>
(CMS:EMAIL submit="$submit" …)
<button name="submit" value="1">Send</button>

successtemplate

After successful sending, this template is included and the page ends (without CMS:CONTINUE):

(CMS:EMAIL successtemplate=contact_thanks …)

message

Own message texts per error case (indexes see Messages):

(CMS:EMAIL message[required]="Please fill in all required fields." …)

attachment

Attaches files relative to the var directory – only from download/, upload/ and modules/:

(CMS:EMAIL attachment[]="download/terms.pdf" …)

throttle

(CMS:EMAIL throttle=true …)
(CMS:EMAIL throttle=newsletter …)

A separate name needs a limit in the configuration (user.throttle.newsletter, system administrator); if it is missing, the limit of true applies.

formguard

(CMS:EMAIL formguard=true …)
<form method="post">(CMS:USER_TOKEN formguard=true) …</form>

← Overview

CMS:MEDIA

Creates an image tag or outputs the content of a media file in text form.

(CMS:MEDIA field [parameter=value …])

Method: Cms::cmsMedia()
Without key: the first value without = is the field
At least one of: field, useval

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

The source is an upload field. Without subfield, an <img> tag is created with the stored dimensions; alt is the original file name:

(CMS:MEDIA image)

Output: <img src="/media/1/12/1977,beach.jpg?v=3" alt="beach.jpg" width="1200" height="800">

The path carries the original file name after a comma (a readable URL for browsers and search engines, as a slug without extension); the file itself is called 1977.jpg – a rewrite rule in the media directory discards the name part without checking it. ?v= carries the version number of the file: after a new upload, the address changes and the browser reloads the file.

With subfield, a single value of the file is output – this way, arbitrary tags can be built or downloads linked:

<a href="(CMS:MEDIA document subfield=path)">
  (CMS:MEDIA document subfield=filename) ((CMS:MEDIA document subfield=size))
</a>

Output: <a href="/media/1/13/1977,terms.pdf?v=3">terms.pdf (123.5 KB)</a>

No image uploaded? ifempty provides the replacement – prefix/suffix are then omitted:

(CMS:MEDIA image width=300 height="" prefix="<figure>" suffix="</figure>" ifempty="<img src='/static/placeholder.png'>")

Available subfield values

url is an alias for path (spelling from C9 preview versions). For multilingual upload fields, the command delivers the file of the current language, or that of the main language as a fallback (1977_2,beach.jpg).

Protected files (field option “Signed-in frontend users only”): the link points automatically to /file.php, which checks the frontend session. auth=true forces this route also for unprotected fields, download="name" offers the file for download.

Parameters in detail

id

id reads from another record instead of the current one – record_id or slug, exactly as in the URL:

(CMS:MEDIA image id=1977)
(CMS:MEDIA image id=imprint)

field

Name of the upload field; may be given without a key:

(CMS:MEDIA field=image)
(CMS:MEDIA image)

subfield

Single value instead of an <img> tag (list see above):

<img src="(CMS:MEDIA image subfield=path)" alt="(CMS:TEXT title specialchars=true)" loading="lazy">
File type: (CMS:MEDIA document subfield=mime_type)

Single values via subfield are not escaped. path contains only URL-safe characters and can stand directly in src or href. The original file name (filename) is chosen by the uploader – in an attribute, escape it via CMS:TEXT:

(CMS:MEDIA document subfield=filename set=filename)
<a href="(CMS:MEDIA document subfield=path)" title="(CMS:TEXT useval="{$set['filename']}" specialchars=true lbrconvert=false)">…</a>

path and file differ in purpose – a link for the browser versus access by PHP:

(CMS:MEDIA document subfield=path)      /media/1/13/1977,terms.pdf?v=3
(CMS:MEDIA document subfield=file)      /var/www/example/public/media/1/13/1977.pdf

(CMS:MEDIA document subfield=file set=file)
<?php echo filesize($set['file']) > 5e6 ? 'large file' : ''; ?>

auth

Force the link via /file.php – for example, so that a preview takes the same access route as the protected original:

<p>Preview: (CMS:MEDIA thumb)</p>
<p>Original (signed-in only): (CMS:MEDIA image auth=true)</p>

For fields with the option “Signed-in frontend users only”, this applies automatically.

download

Offer the file for download; download is the file name when saving, the extension is added:

<a href="(CMS:MEDIA document subfield=path download="GTC-2026")">Download terms</a>

Output: <a href="/file.php?file=13/1977&v=2&download=GTC-2026">Download terms</a>

width

Width of the <img> tag; without specification, the stored image width. An empty value omits the attribute, and the browser then calculates proportionally:

(CMS:MEDIA image width=300 height="")

Output: <img src="/media/1/12/1977,beach.jpg?v=3" alt="beach.jpg" width="300">

height

(CMS:MEDIA image width="" height=200)
(CMS:MEDIA image width="100%" height="")

attr

Further attributes; key = attribute name. Existing ones (src, alt, width, height) can be overridden this way:

(CMS:TEXT title striptags=true ampconvert=false lbrconvert=false set=title)
(CMS:MEDIA image attr[alt]="{$set['title']}" attr[class]="hero" attr[loading]="lazy")

CMS:MEDIA escapes all attribute values of the <img> tag itself with htmlspecialchars – including those from attr. Therefore pass unescaped text, without specialchars=true; otherwise escaping happens twice and & becomes visible as &. From the attribute name, the command removes all characters except letters, digits, _ and -.

autoformat

Affects only subfield=size: readable by default (123.5 KB), in bytes with false:

(CMS:MEDIA document subfield=size)                   123.5 KB
(CMS:MEDIA document subfield=size autoformat=false)  126464

instead

Fixed text if a file is present (the tag or the single value itself is not output):

Image: (CMS:MEDIA image instead="present" ifempty="missing")

ifempty

Replacement if no file is present (or the single value is empty or 0):

(CMS:MEDIA image ifempty="<img src='/static/placeholder.png' alt=''>")
(CMS:MEDIA image subfield=width ifempty="unknown")

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty <figure></figure>:

(CMS:MEDIA image prefix="<figure>" suffix="</figure>")

suffix

(CMS:MEDIA image suffix="</figure>")

See prefix.

useval

Passes a file array instead of a field – e.g. from a record saved with CMS:SAVEDATA. Parameter values in the template are always strings; an array can therefore only be passed via a direct PHP call of the method. field must not be specified in this case – it would take precedence and read the field of the current record. Because the file array does not contain the field id, field_id and record_id belong in it explicitly:

(CMS:SAVEDATA author id="{$cms['author_id']}")
<?php $this->cms->cmsMedia([
    'useval' => $GLOBALS['author']['portrait'] + ['record_id' => $GLOBALS['author']['record_id'], 'field_id' => 17],
    'width'  => 80, 'height' => '',
]); ?>

17 stands here for the id of the upload field portrait. Almost always simpler is (CMS:MEDIA portrait id="{$cms['author_id']}") – id loads the other record directly and finds the field by its name.

set

set outputs nothing, but stores the result under $set['img'] for the surrounding PHP or a later command:

(CMS:MEDIA image subfield=path set=img)
<?php if ($set['img'] !== '') { ?> … <?php echo $set['img']; ?> … <?php } ?>

← Overview

CMS:MESSAGE

Produces a text output from current error messages.

(CMS:MESSAGE useval [parameter=value …])

Method: Cms::cmsMessage()
Without key: the first value without = is the useval

Parameters

¹ can be given without a key as the first value.

Usage

Outputs the messages that commands on this page have stored – typically field errors from CMS:USER_INPUT, CMS:USER_LOGIN or CMS:USER_REGISTER. Without a message, the command stays silent:

(CMS:USER_LOGIN container=members submit="$submit" successtemplate=welcome)
<p class="error">(CMS:MESSAGE)</p>

Several messages are separated by <br>. A frame is only possible through prefix/suffix – it appears only if there are messages:

(CMS:MESSAGE prefix="<div class=alert>" suffix="</div>")

Parameters in detail

useval

Output your own text instead of the system messages (the messages are then ignored; if useval is empty, the messages appear again):

(CMS:MESSAGE useval="{$set['hint']}" prefix="<p class=hint>" suffix="</p>")

The text is output unchanged. Do not insert values from the request ($_GET, $_POST) here – for that, use (CMS:TEXT useval="…" specialchars=true).

prefix

(CMS:MESSAGE prefix="<div class=alert>" suffix="</div>")

Without specification, the messages are output without a frame.

suffix

(CMS:MESSAGE prefix="<ul class=errors><li>" suffix="</li></ul>")

ifempty

Text if no message is present:

(CMS:MESSAGE ifempty="Everything is in order.")

instead

Fixed text as soon as a message is present – if the wording should not be shown:

(CMS:MESSAGE instead="Please check your entries.")

set

Provide messages for PHP, for example to show them next to the respective field:

(CMS:MESSAGE set=errors)
<?php if ($set['errors'] !== '') { ?><div class="alert"><?php echo $set['errors']; ?></div><?php } ?>

← Overview

CMS:NUMBER

Outputs a numeric value, formatted.

(CMS:NUMBER field [parameter=value …])

Method: Cms::cmsNumber()
Without key: the first value without = is the field
At least one of: field, useval

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Outputs a numeric value, formatted. Without further parameters, the number appears as it is stored – with a point as decimal separator and without thousands separator:

(CMS:NUMBER price)                                        1234.5
(CMS:NUMBER price decimal="," thousands_separator=".")    1.234,5
(CMS:NUMBER price decimals=2 decimal="," thousands_separator="." suffix=" €")   1.234,50 €

Calculating before output (mul, add), making file sizes readable (sizefactor):

(CMS:NUMBER price mul=1.19 decimals=2 decimal="," suffix=" € incl. VAT")
(CMS:NUMBER filesize sizefactor=1024)                     15.2 MB

If the calculation results in 0, 0 is output (formatted, e.g. 0.00 with decimals=2):

(CMS:NUMBER useval="{$a}" add=-1)                          0  (with $a = 1)

As soon as prefix, suffix or ifempty is given, however, the value 0 counts as empty – a price of 0 therefore stays without €. What counts is the numeric value after mul/add, not the formatted text: even 0.00 (with decimals or format) then counts as empty. An empty source (field without content, empty useval) always results in empty output – also with mul/add.

Parameters in detail

id

id reads from another record instead of the current one – record_id or slug, exactly as in the URL:

(CMS:NUMBER price id=1977)
(CMS:NUMBER price id=imprint)

field

field is the main parameter and may be given without a key – both lines are the same:

(CMS:NUMBER field=price)
(CMS:NUMBER price)

useval

Instead of a field, useval takes a value directly from the template – usually a PHP variable or a value stored earlier with set:

(CMS:NUMBER useval="{$this->db->num_rows_unlimited}")
(CMS:NUMBER useval="{$set['value']}")

A decimal comma is understood: useval="3,5" gives 3.5.

ifempty

With ifempty, the numeric value 0 also counts as empty – regardless of how it would be formatted:

(CMS:NUMBER stock ifempty="sold out" suffix=" pcs")

Output for stock = 0: sold out – for 12: 12 pcs

instead

instead replaces the source (not the result) if it is not empty – calculation and formatting then run on the new value:

(CMS:NUMBER price instead=99 decimal=",")

mul

(CMS:NUMBER price mul=1.19 decimals=2 decimal="," suffix=" €")   gross price
(CMS:NUMBER share mul=100 suffix=" %")                           0.25 → 25 %

add

(CMS:NUMBER price add=4.90 decimals=2 decimal="," suffix=" € incl. shipping")

mul is applied before add: result = source × mul + add.

format

sprintf() pattern; it alone determines the output, so decimal, thousands_separator, decimals and nullcent are then ignored. For prices with a decimal comma and thousands point, decimals is therefore the right parameter; use format for special cases such as leading zeros:

(CMS:NUMBER price format="%.2f")        1234.50
(CMS:NUMBER position format="%03d")     007

decimals

Fixed number of decimal places, rounded commercially – the separators from decimal and thousands_separator still apply:

(CMS:NUMBER price decimals=2 decimal="," thousands_separator=".")

Output for 1234.5: 1.234,50 – for 19.999: 20,00

An amount in cents (field type currency amount) becomes euros with mul=0.01:

(CMS:NUMBER cur_price mul=0.01 decimals=2 decimal="," suffix=" €")

decimal

(CMS:NUMBER price decimal=",")

Output: 1234,5

thousands_separator

(CMS:NUMBER views thousands_separator=".")
(CMS:NUMBER views thousands_separator=" ")

Output: 1.234.567 or 1 234 567

nullcent

Replacement for missing decimal places (without specification: none) – for prices that should always show two digits:

(CMS:NUMBER price decimal="," nullcent="00" suffix=" €")

Output for 1234: 1234,00 € – for 1234.5 it remains 1234,5 € (only missing decimal places are replaced; use decimals=2 for fixed rounding).

replace

replace replaces parts of text in the already formatted value – short form with ? as separator, or one entry per search text:

(CMS:NUMBER price replace=".00?")
(CMS:NUMBER price replace[.00]="" replace[x]="y")

Output for 12.00: 12

prefix

Appears only if the formatted value is neither empty nor 0:

(CMS:NUMBER discount prefix="- " suffix=" %")

suffix

(CMS:NUMBER price suffix=" €")

See prefix.

set

set outputs nothing, but stores the result under $set['price'] for the surrounding PHP or a later command:

(CMS:NUMBER price set=price)
<?php if ($set['price'] !== '') { ?> … <?php echo $set['price']; ?> … <?php } ?>

The stored value is a string in the formatted notation.

sizefactor

Makes a file size readable (bytes → KB / MB / GB); 1024 for binary, 1000 for decimal units:

(CMS:NUMBER filesize sizefactor=1024)      15.2 MB
(CMS:NUMBER filesize sizefactor=1000)      15.9 MB

For upload fields, this also works directly with (CMS:MEDIA image subfield=size).

← Overview

CMS:RAW

Outputs the content unformatted.

(CMS:RAW field [parameter=value …])

Method: Cms::cmsRaw()
Without key: the first value without = is the field

Parameters

¹ can be given without a key as the first value.

Usage

Outputs the field content without any processing – no escaping, no conversion of line breaks, no entities. Intended for fields that contain finished HTML (editor fields) or for values that are to be passed unchanged to PHP/JavaScript:

<div class="content">(CMS:RAW html_text)</div>

You must trust the content: whatever an editor writes into the field ends up on the page unchanged – except for active content (<script>, <iframe>, event handlers, javascript: links), which camindo CMS already removes when saving and when reading from the database. For texts from user input (ugc areas) use CMS:TEXT with specialchars=true.

The output parameters ifempty, instead, prefix, suffix and set work as with all output commands.

Parameters in detail

id

id reads from another record instead of the current one – record_id or slug, exactly as in the URL:

(CMS:RAW html_text id=1977)
(CMS:RAW html_text id=imprint)

field

field is the main parameter and may be given without a key – both lines are the same:

(CMS:RAW field=html_text)
(CMS:RAW html_text)

ifempty

ifempty replaces the entire output if the source is empty; prefix and suffix are then omitted:

(CMS:RAW html_text prefix="<p>" suffix="</p>" ifempty="<p>No content.</p>")

instead

instead replaces the value as soon as the source is not empty – useful if only the presence matters:

(CMS:RAW html_text instead="present" ifempty="-")

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty <section></section>:

(CMS:RAW html_text prefix="<section>" suffix="</section>")

suffix

(CMS:RAW html_text suffix="</section>")

See prefix.

set

set outputs nothing, but stores the result under $set['html'] for the surrounding PHP or a later command:

(CMS:RAW html_text set=html)
<?php if ($set['html'] !== '') { ?> … <?php echo $set['html']; ?> … <?php } ?>

← Overview

CMS:SNIPPET

Outputs a snippet (text module) in the language of the call.

(CMS:SNIPPET key [parameter=value …])

Method: Cms::cmsSnippet()
Without key: the first value without = is the key

Parameters

¹ can be given without a key as the first value.
[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Fixed labels of a website – “Read more”, “Add to cart”, headings of lists – are maintained by the editorial team as snippets of the instance in all languages (module Snippets, see Manual for administrators). The template outputs them with CMS:SNIPPET, always in the language of the call; if a translation is missing, the English text (en_US) appears:

<a class="more" href="(CMS:URL)">(CMS:SNIPPET custom.read_more)</a>

custom. refers to the snippet set of the instance. Without a prefix, the snippets of the core are meant – on the front end only the general ones, not those of the back-end interface.

In an attribute, mask the text with specialchars=true:

<button aria-label="(CMS:SNIPPET custom.menu specialchars=true)">…</button>

Placeholders. param[name] replaces {name} in the snippet. This leaves the word order to the translation – for example, the currency sign before or after the amount:

Snippet custom.price:   en "€{amount}"   de "{amount} €"
(CMS:NUMBER price mul=0.01 format="%.2f" set=amount)
(CMS:SNIPPET custom.price param[amount]="{$set['amount']}")

If a snippet begins with an ICU message ({count, plural, one {# item} other {# items}}), param fills in its values:

(CMS:SNIPPET custom.hits param[count]="{$set['count']}")

Key from the record. The key may contain PHP variables – for example, to translate a selection value:

(CMS:SNIPPET "custom.status_{$cms['status']}" ifempty="–")

If the snippet does not exist, the key itself appears on the page – so a missing text is noticed during development. ifempty outputs a replacement instead.

Inside a parameter of another command, CMS:SNIPPET cannot be nested; there, {$this->cms->snippet('custom.read_more')} returns the text:

(CMS:TEXT teaser suffix=" {$this->cms->snippet('custom.read_more')}")

← Overview

CMS:TEXT

Outputs a text with formatting applied.

(CMS:TEXT field [parameter=value …])

Method: Cms::cmsText()
Without key: the first value without = is the field
At least one of: field, useval, id

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

The standard command for field contents. It reads a field of the current record, converts line breaks into <br>, escapes standalone & and outputs the result:

<h1>(CMS:TEXT title)</h1>
<p>(CMS:TEXT text)</p>

Output a field only if it is filled – prefix/suffix appear only for a non-empty value:

(CMS:TEXT teaser prefix="<p class=teaser>" suffix="</p>")

Cache a value for PHP instead of outputting it:

(CMS:TEXT title set=title)
<title><?php echo $set['title']; ?> – Example Ltd.</title>

Translate a status value into text:

(CMS:TEXT status_id if[0]="online" if[1]="blocked" if[2]="unconfirmed" else="unknown")

Order of processing: source → if/else → replace → trim → striptags → limit → (markdown or urlencode end here) → entitydecode → specialchars or ampconvert → urlconvert / emailconvert → lbrconvert → iso/charset → ifempty / instead / prefix / suffix → output or set.

Parameters in detail

id

id reads from another record – record_id or slug, as in the URL. Only with CMS:TEXT may id stand alone: then the field text is read. As in the URL, the record must be published (released, publication date reached; an expired one remains readable), otherwise the value is empty – also in the preview of the back end.

(CMS:TEXT title id=1977)          Title of record 1977
(CMS:TEXT id=imprint)             Field "text" of the record with the slug "imprint"

field

field is the main parameter and may stand without a key – both lines are the same:

(CMS:TEXT field=title)
(CMS:TEXT title)

useval

useval takes a value directly from the template instead of a field – usually a PHP variable or a value previously stored with set:

(CMS:TEXT useval="{$_GET['q']}" specialchars=true)
(CMS:TEXT useval="{$set['value']}")

Always output values from the request ($_GET, $_POST) with specialchars=true – otherwise a manipulated link can place arbitrary HTML and script into the page.

This also allows the text filters (striptags, specialchars, limit …) to be applied to foreign values.

ifempty

ifempty replaces the entire output if the source is empty; prefix and suffix are then omitted:

(CMS:TEXT teaser prefix="<p>" suffix="</p>" ifempty="No teaser available.")

Note: if the source is empty, all conversions are skipped as well – the ifempty text is output unchanged.

instead

instead replaces the value as soon as the source is not empty – useful when only the presence counts:

(CMS:TEXT image instead="✔ image available" ifempty="-")

entitydecode

By default, entities (&, ä, –) are converted back into characters. For content that should keep the entities (for example for XML feeds):

(CMS:TEXT text entitydecode=false)

trim

(CMS:TEXT title trim=true prefix="[" suffix="]")

Output: [Hello world] instead of [ Hello world ]

striptags

Removes HTML and script tags, for example for teasers from an HTML field or for meta tags. Each tag is replaced by a space (from <p>a</p><p>b</p> comes a b); the text between the tags remains:

<meta name="description" content="(CMS:TEXT text striptags=true limit=160 lbrconvert=false)">

if

Value table: if the value matches a key, the entry becomes the new source. Two notations – subkey or short form with a question mark:

(CMS:TEXT status_id if[0]="online" if[1]="blocked")
(CMS:TEXT status_id if="0?online" if[]="1?blocked")

Values that do not match remain unchanged – unless else is given.

If the replacement text of a numeric key itself contains a question mark, use the short form: if[]="1?Really?". With if[1]="Really?" it would not be clear whether 1 is the search value or whether the short form Really → empty was meant (in PHP both notations give the key 1). For text keys (if[active]="Yes?") this does not apply.

else

(CMS:TEXT status_id if[0]="online" else="not online")

Output for status_id = 2: not online

replace

Replace partial texts in the source – short form with ? or one entry per search text:

(CMS:TEXT text replace="\n?<br><br>" lbrconvert=false)
(CMS:TEXT title replace[Ltd.]="Limited" replace[&]="and")

As with if, write replacement texts with a question mark for a numeric search text in the short form (replace[]="0?zero?").

limit

Shortens a text to a number of characters; an appended s shortens at the last word end (“soft”). The snippet ellipsis (…) is appended:

<p>(CMS:TEXT text striptags=true limit=200s)</p>
<td>(CMS:TEXT title limit=30)</td>

lbrconvert

By default, line breaks become <br>. Switch this off for content in <pre>, in attributes or in JavaScript:

<pre>(CMS:TEXT code lbrconvert=false)</pre>

specialchars

Escapes all special characters (< → <, " → " …) – for attributes and for content that must not contain HTML:

<input value="(CMS:TEXT title specialchars=true lbrconvert=false)">

urlconvert

Makes addresses (http://…, https://…, www.…) in the text clickable:

(CMS:TEXT text urlconvert=true target=_blank urllimit=24)

Output: <a href="https://example.com/a/very/long/address" target="_blank">https://example.com/a/very…</a>

emailconvert

Links email addresses; encrypt assembles the link by means of JavaScript, so that the address does not appear in the source code. The <script> for this carries the nonce of the page and therefore also runs under an enforced script policy (CMS:CSP):

(CMS:TEXT contact emailconvert=true)
(CMS:TEXT contact emailconvert=encrypt emailtext="Write an email")

emaillimit

Shortens the visible part of a linked address:

(CMS:TEXT contact emailconvert=true emaillimit=12)

Output: <a href="mailto:editorial@example.com">editorial@ex…</a>

emailtext

Fixed link text instead of the address (only with emailconvert):

(CMS:TEXT contact emailconvert=true emailtext="Get in touch")

target

Link target for the links generated by urlconvert:

(CMS:TEXT text urlconvert=true target=_blank)

markdown

Outputs a field that contains Markdown – for example one with the extension Markdown (visual) – and converts it into HTML:

<div class="text">(CMS:TEXT text markdown=true)</div>

Conversion is done with Parsedown; HTML in the text is escaped, and links to javascript: and similar targets are neutralized. In addition to the usual Markdown, the parameter understands the formats of the extension Markdown (visual):

markdown ends the processing: entitydecode, specialchars, lbrconvert, urlconvert and so on do not apply. prefix, suffix, ifempty and set work as usual.

urlencode

Encodes the value as a URL component. All further conversions do not apply then:

<a href="/search?q=(CMS:TEXT title urlencode=true)">similar articles</a>

Output: /search?q=Hello%20world

urllimit

Visible length of automatically linked addresses (default 80 characters, 0 = not shortened):

(CMS:TEXT text urlconvert=true urllimit=30)

ampconvert

By default a standalone & becomes &; existing entities remain. Switch off if the content is already fully escaped:

(CMS:TEXT html_snippet ampconvert=false)

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty <p class=teaser></p> is created:

(CMS:TEXT teaser prefix="<p class=teaser>" suffix="</p>")

suffix

(CMS:TEXT author_name suffix=" (author)")

See prefix.

iso

Re-encodes the output as ISO-8859-1 (short form for charset=ISO-8859-1), for example for older interfaces:

(CMS:TEXT title iso=true)

charset

(CMS:TEXT title charset=windows-1252)

set

set outputs nothing, but stores the result under $set['title'] for the surrounding PHP or a later command:

(CMS:TEXT title set=title)
<?php if ($set['title'] !== '') { ?> … <?php echo $set['title']; ?> … <?php } ?>

← Overview

CMS:TIME

Outputs the time of a date or time value, formatted.

(CMS:TIME field [parameter=value …])

Method: Cms::cmsTime()
Without key: the first value without = is the field
At least one of: field, useval

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Outputs only the time of a date/time value:

(CMS:TIME event_at)                    14:30
(CMS:TIME event_at format="HH:mm:ss")  14:30:00
(CMS:TIME event_at suffix=" o'clock")  14:30 o'clock

Without format, full minutes are shown without seconds.

Parameters in detail

id

id reads from another record instead of the current one – record_id or slug, exactly as in the URL:

(CMS:TIME event_at id=1977)
(CMS:TIME event_at id=imprint)

field

field is the main parameter and may be given without a key – both lines are the same:

(CMS:TIME field=event_at)
(CMS:TIME event_at)

useval

Instead of a field, useval takes a value directly from the template – usually a PHP variable or a value stored earlier with set:

(CMS:TIME useval="2024-03-07 14:30:00")
(CMS:TIME useval="{$set['value']}")

format

format is an ICU pattern (d day, MM month with two digits, MMMM month name, y year, HH:mm time, EEEE weekday). Without format, the language of the page decides (in the back end, the locale of the user):

(CMS:TIME online_at format="HH:mm")

Output: 14:30

h:mm a gives the 12-hour notation (2:30 PM).

timezone

(CMS:TIME event_at timezone=true)

Output: 14:30 Europe/Berlin

replace

replace replaces parts of text in the already formatted value – short form with ? as separator, or one entry per search text:

(CMS:TIME event_at replace=":?.")
(CMS:TIME event_at replace[:]="." replace[x]="y")

Output: 14.30

ifempty

ifempty replaces the entire output if the source is empty; prefix and suffix are then omitted:

(CMS:TIME event_at prefix="<p>" suffix="</p>" ifempty="all day")

instead

instead replaces the value as soon as the source is not empty – useful if only the presence matters:

(CMS:TIME event_at instead="with time" ifempty="-")

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty from o'clock:

(CMS:TIME event_at prefix="from " suffix=" o'clock")

suffix

(CMS:TIME event_at suffix=" o'clock")

See prefix.

set

set outputs nothing, but stores the result under $set['time'] for the surrounding PHP or a later command:

(CMS:TIME event_at set=time)
<?php if ($set['time'] !== '') { ?> … <?php echo $set['time']; ?> … <?php } ?>

← Overview

CMS:URL

Creates the URL of a record.

(CMS:URL id [parameter=value …])

Method: Cms::cmsUrl()
Without key: the first value without = is the id

Parameters

¹ can be given without a key as the first value.

Usage

Creates the front-end URL of a record – with the slug if it has one, otherwise with the record_id; for multilingual websites always with a language segment:

<a href="(CMS:URL)">(CMS:TEXT title)</a>

Output: <a href="/en/hello-world">Hello world</a>

Link to another view of the same record (template), to another record (id) or into another language (lang):

(CMS:URL template=print)                /en/hello-world,print
(CMS:URL 1977)                          /en/1977   (record without slug)
(CMS:URL imprint lang=de)               /de/impressum   (slug of the target language)
(CMS:URL colors/blue)                   /en/colors/blue   (area with slug prefix)

If the content area of the record has a slug prefix (setting of the area, e.g. colors), it precedes the slug: /en/colors/blue. The prefix applies per language – with lang, therefore, the prefix of the target language. An id with a slug means the path as it appears in the address (id=colors/blue); id=blue finds only a record of an area without a prefix.

Language switcher – in a CMS:SELECT_LANGVERSION list template. The rows there are languages, not records; CMS:URL without id therefore points to the record of the page:

<a href="(CMS:URL lang="{$cms['code']}")">(CMS:TEXT endonym)</a>

Absolute URL for feeds, emails or og:url:

<link rel="canonical" href="(CMS:URL absolute=true)">

Parameters in detail

id

Record to link to; without specification, the current one. May be given without a key:

(CMS:URL 1977)
(CMS:URL id=imprint)
(CMS:URL "{$cms['parent_id']}")       link to the parent node

area

Links to the overview of an area: the address that consists only of its slug prefix, in the language of the call or from lang. It shows the overview template of the area (setting of the area, “Template assignment”):

<a href="(CMS:URL area=events)">All events</a>        /en/events
(CMS:URL area=events lang=de)                         /de/termine

If the area has no slug prefix, the output remains empty. In the overview template itself there is no current record; CMS:URL without id therefore points there to the same overview – a language switcher with CMS:SELECT_LANGVERSION therefore works as on every record page.

template

Second part of the URL (after the comma): the template with which the record is to be shown – name or area.name:

(CMS:URL template=print)
(CMS:URL template=articletemplates.print)

Output: /en/hello-world,print

lang

Language version to which the link points (code from language management); without specification, the language of the current call:

(CMS:URL lang=de)

If the website runs only one language, a language segment never appears in the URL. A code that the website does not run is ignored – the URL keeps the language of the call.

If the field slug of the area is multilingual, each language version has its own slug – and the target URL must carry the slug of the target language, because it is resolved in the language of the URL. CMS:URL therefore inserts it itself with lang:

Page /en/dining-table-nord-180

(CMS:URL lang=de)        /de/esstisch-nord-180
(CMS:URL lang=sv)        /sv/matbord-nord-180

If the slug is not translated into the target language, the slug of the main language appears there. If the instance of the record does not run the target language, its main language applies. If no slug is found, the record_id appears in the URL (with canonical = 1, the page redirects from there to the slug). This costs one database query per record and language, which is remembered for the call; without lang, or with a single-language slug field, there is no query.

protocol

Only together with absolute or host:

(CMS:URL absolute=true protocol=https)

Output: https://www.example.com/en/hello-world

host

Another domain; implies absolute=true:

(CMS:URL host=shop.example.com)

Output: https://shop.example.com/en/hello-world (protocol of the instance)

absolute

Complete URL with protocol and main domain of the instance:

<link rel="canonical" href="(CMS:URL absolute=true)">

Output: <link rel="canonical" href="https://www.example.com/en/hello-world">

set

set outputs nothing, but stores the result under $set['url'] for the surrounding PHP or a later command:

(CMS:URL  set=url)
<?php if ($set['url'] !== '') { ?> … <?php echo $set['url']; ?> … <?php } ?>

← Overview

CMS:XML

Creates an XML declaration.

(CMS:XML encoding [parameter=value …])

Method: Cms::cmsXml()
Without key: the first value without = is the encoding

Parameters

¹ can be given without a key as the first value.

encoding and version are output escaped with htmlspecialchars.

Usage

Creates the XML declaration <?xml version="1.0" encoding="utf-8"?>. It must be the first character of the output – the command therefore stands in the first line of a feed template, without a blank line before it:

(CMS:XML)
<rss version="2.0">
  <channel>
    <title>(CMS:TEXT title specialchars=true lbrconvert=false)</title>
    (CMS:SELECT filter[area]=articles limit=20 resulttemplate=rss_item)
  </channel>
</rss>

Matching this, (CMS:HEADER "Content-Type: application/rss+xml; charset=utf-8") – it outputs nothing itself and therefore stands before (CMS:XML) on the same line, or without a blank line in between:

(CMS:HEADER "Content-Type: application/rss+xml; charset=utf-8")(CMS:XML)
<rss version="2.0">

Typing the declaration into a template directly would not work: <?xml would be read by PHP as an opening tag.

Parameters in detail

encoding

(CMS:XML encoding=ISO-8859-1)

Output: <?xml version="1.0" encoding="ISO-8859-1"?> – then output the content with charset=ISO-8859-1.

version

(CMS:XML version=1.1)

← Overview

CMS:ZIP

Offers the files of several records as a ZIP archive for download and ends the page.

(CMS:ZIP field=field[,field…] filter[…]=value | relation=field | ids=… | source=basket [parameter=value …])

Method: CmsZip::cmsZip() (service loaded on demand, see below)
Without key: the first value without = is the field
Required: field and a selection: filter, relation, ids or source

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Press pictures of a release, all motifs of a model, the selection from a light box: CMS:ZIP packs the files of several records into an archive and sends it to the visitor as a download. The page ends with it – what follows in the template appears only if no archive was created.

The command therefore belongs at the beginning of its own template, before any output (the frontend does not buffer; after the first output, the command reports an error). A stand-alone template that is called without a record is well suited:

(CMS:NUMBER useval="{$_GET['id']}" set=zip_id)
(CMS:ZIP relation=images src_id="{$set['zip_id']}" sort="_custom asc"
         field="fil_print,fil_web" name="Press pictures" credits="title,caption,photo_credit")
(CMS:INCLUDE layout_head)
(CMS:MESSAGE prefix="<div class='error'>" suffix="</div>")
(CMS:INCLUDE layout_foot)

It is linked with the id of the record whose pictures are meant:

(CMS:URL id=0 template=press_pictures_zip set=zip_url)
<a href="<?php echo $set['zip_url']; ?>?id=(CMS:TEXT record_id)">All pictures as ZIP</a>

CMS:NUMBER turns the address parameter into a number. If it is missing, src_id is empty – then there are no files, never “all”.

Which records. The selection follows the same rules as CMS:SELECT: filter, relation with src_id or ids. Only published records count from the instances of the website (future and archive as with CMS:SELECT). One specification is required – without a selection, no archive is created.

With source=basket, the records come from the basket of the session (CMS:USER_BASKET). A separate category separates the light box from shopping:

(CMS:USER_BASKET add variable=images category=2)       in the template of the light box
(CMS:ZIP source=basket category=2 field=fil_web name=Selection)   in the download template

Which file. field names one or more file fields. For each record, the first file that the visitor may also retrieve individually goes into the archive – the same check as for a download via file.php. If a field is released only for signed-in visitors, only those who are signed in with a suitable profile receive it; everyone else receives the next field in the list. Thus field="fil_print,fil_web" gives the signed-in press the print version, and everyone else the web version. Records without an allowed file are skipped.

File names. filenames determines the names in the archive:

The extension is added if the pattern does not contain it; duplicate names receive -2, -3 …

Image credits. credits adds a CREDITS.txt – for each file its name and below it the contents of the named fields, for example title, caption and photographer.

Limits. An archive contains at most user.zip.max_files files (default 100) with a total of user.zip.max_mb MB (default 500). maxfiles and maxsize can only reduce these values for a template. If the selection exceeds the size, no archive is created.

Finished archives remain in the cache for user.zip.retention_hours hours (default 24); the same selection is delivered from the cache. New archives are throttled per origin (user.throttle.zip_ip, default 30 per hour).

Messages. If no archive is created, the template continues to run. CMS:MESSAGE outputs the message, $set['zip_error'] names the reason:

The texts come from the core snippets zip_error_empty, zip_error_limit and zip_error_throttled; message[empty]=… etc. replaces them in the template.

← Overview

CMS:RELATION

Important: CMS:RELATION is intended only for back-end templates (list and trigger templates). It does not check access rights: it returns the linked records regardless of instance and area rights. As with CMS:SELECT, however, only published targets count (released, publication date reached, expiry date not reached) – also in the back end and in the preview; future, archive and state relax this. Records in the trash and working copies never appear.

Outputs the main field (title) of all records that are linked to the current record via a relation field – in the preferred language version of the back end (per instance; if an instance does not offer it, its main language). Records with an empty main field do not appear.
For front-end templates, use (CMS:SELECT relation=…)

(CMS:RELATION field [parameter=value …])

Method: Cms::cmsRelation()
Without key: the first value without = is the field

Parameters

¹ can be given without a key as the first value.

Usage

Outputs the main field (title) of all records to which a relation field of the current record points – in the order defined in the back end:

Topics: (CMS:RELATION topics separator=", ")

Output: Topics: Travel, Photography, Iceland

The command returns only the titles. If the linked records themselves are to be output (with image, link, date …), CMS:SELECT relation=topics is the right way:

(CMS:SELECT relation=topics resulttemplate=topic_badge)

Reverse relations (which articles point to this topic?) work via CMS:SELECT filter[topics]="{$cms['record_id']}".

Parameters in detail

field

Name of the relation field; may be given without a key:

(CMS:RELATION field=topics)
(CMS:RELATION topics)

id

The relations of another record – by record_id or slug, as in the URL. The record must be published as in the URL, otherwise the output remains empty:

(CMS:RELATION topics id=1977)
(CMS:RELATION topics id=island-trip)

limit

(CMS:RELATION topics limit=3 separator=", ")

At most three titles are output – the first three in the order of the relation field.

future

Also targets whose publication date has not yet been reached:

(CMS:RELATION dates future=true separator=", ")

archive

Also expired targets:

(CMS:RELATION topics archive=true)

state

All targets regardless of status – for example in a list template of the back end:

(CMS:RELATION topics state=any future=true archive=true)

lang

Not yet implemented – the language of the call applies.

(CMS:RELATION topics lang=en)

separator

(CMS:RELATION topics separator=", ")
(CMS:RELATION topics separator="</li><li>" prefix="<ul><li>" suffix="</li></ul>")

The second line produces a list: <ul><li>Travel</li><li>Photography</li></ul>.

prefix

prefix / suffix surround the value and appear only if it is not empty – so no empty Topics::

(CMS:RELATION topics prefix="Topics: " suffix="")

suffix

(CMS:RELATION topics suffix=".")

See prefix.

ifempty

ifempty replaces the entire output if the source is empty; prefix and suffix are then omitted:

(CMS:RELATION topics prefix="<p>" suffix="</p>" ifempty="no topics assigned")

instead

instead replaces the value as soon as the source is not empty – useful if only the presence matters:

(CMS:RELATION topics instead="Topics present" ifempty="-")

set

set outputs nothing, but stores the result under $set['topics'] for the surrounding PHP or a later command:

(CMS:RELATION topics set=topics)
<?php if ($set['topics'] !== '') { ?> … <?php echo $set['topics']; ?> … <?php } ?>

← Overview

CMS:SELECT

Searches the database using the given (filter) criteria and returns the records found.

(CMS:SELECT resulttemplate [parameter=value …])

Method: Cms::cmsSelect()
Without key: the first value without = is the resulttemplate
At least one of: filter, relation
PHP fragments: push_result (before) · include, pop_result (after)

Parameters

¹ can be given without a key as the first value.
² at least one of the parameters marked with ² must be given.

[…] – the parameter accepts subkeys, for example name[key]=value.

Usage

Queries records and includes the resulttemplate for the hits; in it, CMS:RESULT_START … CMS:RESULT_END runs over the rows. The command is the core of every list.

Only published records are found: released (status_id 0), publication date (online_at) reached, end (offline_at) not reached. The parameters future, archive and state relax this per query – also in the preview from the back end, which shows an unpublished record but shows the lists in it the way the website shows them.

<h2>Latest articles</h2>
(CMS:SELECT article_teaser
  filter[area]=articles
  sort=online_at order=desc
  limit=10
  noresult="<p>No articles yet.</p>"
)

List template article_teaser:

<ul>
(CMS:RESULT_START)
  <li><a href="(CMS:URL)">(CMS:TEXT title)</a> – (CMS:DATE online_at)</li>
(CMS:RESULT_END)
</ul>

Common patterns:

A record by slug:              (CMS:SELECT detail filter[slug]=imprint limit=1)
Only one topic:                (CMS:SELECT list filter[area]=articles filter[topics]=42)
Search in the title:           (CMS:SELECT list filter[area]=articles filter[title]="*{$_GET['q']}*")
Time period:                   (CMS:SELECT list filter[area]=articles filter[online_at] >= 2026-01-01)
Linked records:                (CMS:SELECT topic_badge relation=topics)
Children in the tree:          (CMS:SELECT nav filter[parent_id]="{$cms['record_id']}" filter[depth]=1 sort=position order=asc)
Pageable list:                 (CMS:SELECT list filter[area]=articles limit=20 skip="{$_REQUEST['skip']}" count=true)
Search form with sorting:      (CMS:SELECT list filter[area]=articles limit=20 count=true request="filter[title],sort,order,skip")

Several values for the same field are combined with OR (filter_mode[field]=AND switches this); different fields are always combined with AND. Comparison operators stand between key and value (filter[price] > 100, filter[color] != red) or directly before the value (">100"); wildcards and (empty) belong in the value (Hen*). The complete filter syntax is in the Basics.

A CMS:SELECT may stand inside a list template (nested lists); the outer result is set aside automatically and resumed afterwards.

Parameters in detail

resulttemplate

List template for the hits; may stand without a key. Name or area.name:

(CMS:SELECT resulttemplate=article_teaser filter[area]=articles)
(CMS:SELECT article_teaser filter[area]=articles)
(CMS:SELECT articletemplates.article_teaser filter[area]=articles)

noresulttemplate

Template for no hits – for example with a search form or a note:

(CMS:SELECT search_result filter[area]=articles filter[title]="*{$_GET['q']}*" noresulttemplate=search_empty)

noresult

Short text for no hits, without its own template:

(CMS:SELECT list filter[area]=articles noresult="<p>No entries.</p>")

filter

Key = field name (own fields, meta fields such as record_id, status_id, online_at, parent_id, user_id, the virtual slug, _default for the main field, area for the area name); value = search value with an optional operator:

filter[area]=articles                    area by name (number = area_id)
filter[area]=articles,news               two areas (OR)
filter[title]="Hen*"                     begins with
filter[price] > 100                      greater than
filter[price]=">100"                     the same, operator in the value
filter[price]=">100 AND <500"            expression in one field
filter[online_at]=2026                   the whole year
filter[date] >= today                    from today on (0:00, time zone of the call)
filter[online_at] > utc_now-7d           the last seven days, calculated in UTC
filter[teaser]="(empty)"                 empty / not translated
filter[image]="(empty)"                  file field without a file
filter[topics]=42                        link field points to record 42
filter[topics]="(empty)"                 link field without a link
filter[relation_any]=42                  any link field points to 42
filter[topics.title]="Iceland"           field of the linked record
filter[tags]=a filter[tags]=b            two values, OR (see filter_mode)
filter[parent_id]=17 filter[depth]=1     direct children of 17
filter[parent_id]=null filter[depth]=1   top level (records without a parent record)

filter[depth] is not a filter on a record’s indentation; it states how many levels below filter[parent_id] are searched: 1 = direct children only, 2 = down to the grandchildren, omitted = all descendants. Without filter[parent_id] it has no effect (a note when saving the template, or with debug=true); filter[depth]=0 returns no records. The value under “Indent levels” in the record info (0 = top level), by contrast, is absolute – you find the top level with filter[parent_id]=null filter[depth]=1.

Text fields are compared and sorted according to the rules of the language in which you search: upper and lower case and accents do not matter, ß equals ss; in German, in addition, ä equals ae (filter[title]="Mue*" finds “Müller”); in Swedish, by contrast, ö is a letter of its own (o does not find ö). The rules follow from the language code; see Basics.

An empty value cancels the filter – handy for optional filters from the request, risky with typos: filter[category]="{$cms['id']}" (there is no key id; the correct key is record_id) returns all records.

filter_mode

Combination of several values of the same field (default OR):

(CMS:SELECT list filter[area]=articles filter[tags]=travel filter[tags]=iceland filter_mode[tags]=AND)

Finds articles that carry both tags.

filter_op

Comparison operator separate from the value – equivalent to writing it in the value and to the operator between key and value:

(CMS:SELECT list filter[area]=articles filter[price]=100 filter_op[price]=">")
(CMS:SELECT list filter[area]=articles filter[price]=">100")
(CMS:SELECT list filter[area]=articles filter[price] > 100)

skip

Offset for paging; usually from the request. skip only works together with limit – without limit it is ignored, and the query then returns all hits from the first one on:

(CMS:SELECT list filter[area]=articles limit=20 skip="{$_REQUEST['skip']}" count=true)

The page navigation (CMS:JUMP_LIST) stands in the resulttemplate list.

limit

(CMS:SELECT teaser filter[area]=articles limit=3)

At most three hits. Without limit (or with 0) the query returns all hits – for large areas, a limit therefore always belongs. limit is at the same time the page size of the paging commands CMS:JUMP_LIST, CMS:JUMP_PREV and CMS:JUMP_NEXT in the resulttemplate; without limit there is no page navigation.

sort

Sort field; direction via order or directly in the value:

sort=online_at order=desc
sort="title asc"
sort=position order=asc                     order from the back end (tree/list)
sort=_default                               main field of the area
sort=area                                   by area name
sort=author.name                            field of the linked record
sort[]=status_id sort[]=title order[]=asc order[]=asc

order

Direction for sort: asc (default as soon as sort is given) or desc. Without sort, the command sorts by changed_at desc – the most recently changed first.

(CMS:SELECT list filter[area]=articles sort=title order=asc)

lang

Not yet implemented – the language of the call applies.

relation

Hits are the records to which the link field of the source record points – without src_id those of the current record. The order of the link field is given by sort=_custom; without sort, the default sorting applies (changed_at desc):

(CMS:SELECT topic_badge relation=topics)
(CMS:SELECT gallery relation=images sort="_custom asc")

Several field names, comma-separated, count as OR; ANY means any link field. sort=_custom and nextof require exactly one field name.

(CMS:SELECT teaser relation="topics,tags")
(CMS:SELECT teaser relation=any)

The reverse direction – records that point to the current one:

(CMS:SELECT product_list relation=rel_products)
(CMS:SELECT product_list filter[area]=products filter[category]="{$cms['record_id']}")
(CMS:SELECT reference_list relation=any dest_id="{$cms['record_id']}")

The first line applies to relation fields (relation): they have a counterpart field rel_{areaname} in the target area. Pointer fields (pointer) have none – their counterpart is the filter on the pointer field (second line). See Every record has a page.

src_id

Source record for relation, if it is not the current record that is meant:

(CMS:SELECT topic_badge relation=topics src_id=1977)
(CMS:SELECT topic_badge relation=topics src_id="{$set['user_id']}")

An empty value or 0 also means the current record. If there is none – for example in a standalone template without a record – the query finds nothing (and not all records of the area).

dest_id

The reverse direction to relation: hits are the records that point to dest_id via the pointer field – with relation=any via any of them – for example “Where is this image used?”:

(CMS:SELECT reference_list relation=any dest_id="{$cms['record_id']}")
(CMS:SELECT article_list relation=topics dest_id=1977)

With dest_id, the command does not use a current record as the source without src_id. The same as a filter value, also for several targets: filter[relation_any]="1977,1978".

nextof

Only together with relation: instead of all linked records, the neighbors of the record nextof in the same link list – the entries after it with order=asc (default), those before it with order=desc, in each case in the order of the list (the sorting is thereby fixed, sort is ignored). With limit=1 this is the next or previous record – for example for “next”/“back” in an image gallery whose images hang on article 2422:

(CMS:SELECT gallery_next relation=images src_id=2422 nextof="{$cms['record_id']}" limit=1)
(CMS:SELECT gallery_back relation=images src_id=2422 nextof="{$cms['record_id']}" order=desc limit=1)

If nextof is not in the list, there are no hits.

count

Determine the total regardless of limit/skip – the basis for CMS:JUMP_* and for information such as “hits 21–40 of 137”:

(CMS:SELECT list filter[area]=articles limit=20 skip="{$_REQUEST['skip']}" count=true)

In the resulttemplate list there are then two numbers: $this->db->num_rows are the hits of this page (at most limit), $this->db->num_rows_unlimited are all hits of the query:

(CMS:NUMBER useval="{$this->db->num_rows_unlimited}") hits
(CMS:RESULT_START) … (CMS:RESULT_END)
(CMS:JUMP_LIST)

Both numbers apply only in the resulttemplate: after the CMS:SELECT, the surrounding result is active again – the same rule that makes nested lists possible. If only the number is needed, count in the calling template with hits=false.

hits

hits=false only counts (count=true is thereby included): no records are loaded and no resulttemplate is included – the name must nevertheless be given. The total is then available in the calling template in $this->db->num_rows_unlimited:

(CMS:SELECT x filter[area]=articles filter[topics]=42 hits=false)
(CMS:NUMBER useval="{$this->db->num_rows_unlimited}") articles on this topic

If the number is 0, noresult or noresulttemplate apply as usual:

(CMS:SELECT x filter[area]=articles filter[topics]=42 hits=false noresult="No articles on this topic yet.")

If the counting CMS:SELECT stands in a resulttemplate, the number there replaces the total of the surrounding result; $this->db->num_rows and the running result loop remain untouched. A page navigation (CMS:JUMP_LIST) of the surrounding result then belongs before the counting CMS:SELECT.

archive

Include expired records (offline_at reached) – for example for an archive of past events:

(CMS:SELECT archive filter[area]=events archive=true sort=online_at order=desc)

An expired record remains reachable at its own address, by the way; it is only missing from lists without archive.

future

Include pre-dated records (online_at not yet reached) – for example a preview of upcoming posts:

(CMS:SELECT upcoming filter[area]=articles future=true filter[online_at] > now)

debug

Output the SQL and bind values of the query (for development only). Above them, dropped filters are listed with the reason – for example an unknown field name or filter[depth] without filter[parent_id]:

(CMS:SELECT list filter[area]=articles debug=true)

sql

Raw SQL for the WHERE clause – for support only; do not pass user input into it:

(CMS:SELECT list filter[area]=articles sql="AND `record`.`record_id` % 2 = 0")

set

The entire output – the list template with all hits, for noresult its text – ends up in $set instead of on the page. In this way, an address from a query can be reused in another command:

(CMS:SELECT url_only filter[area]=pages filter[identifier]=cart limit=1 set=cart_url)
<a class="cart" href="<?php echo $set['cart_url']; ?>">…</a>
(CMS:TEXT title prefix="<a href='{$set['cart_url']}'>" suffix="</a>")

The output of debug=true and PHP notices from the list template also end up in $set and not on the page – to investigate, temporarily leave out set. If the page ends within the query (for example through a success template), what has been generated up to that point is output normally.

state

Without a value only released records (status_id 0). A status ID finds only records with exactly this status; any removes the status filter:

(CMS:SELECT list filter[area]=articles state=2)
(CMS:SELECT list filter[area]=articles state=any)

request

Takes filters, sorting and paging from the URL (GET or POST) – for search forms and sortable lists, without writing every value into the command. You state what may be taken over, as a comma list or an array:

request="sort,order,skip"                                  only sorting and paging
request="filter[title],filter[price],filter_op[price]"     search in title and price
request[]=sort request[]="filter[title]"                   the same as an array

Permitted are skip, limit, sort, order as well as filter, filter_op and filter_mode only with a field name (filter[title]). A filter without a field name and all are ignored and reported as errors – otherwise a visitor could search by any field of the records found, including fields the page does not even show, such as an internal note.

In the URL the keys are named as in the command, only filterop and filtermode without the underscore: ?filter[title]=Hen*&sort=title&order=desc&skip=20.

(CMS:SELECT list filter[area]=articles limit=20 count=true request="filter[title],sort,order,skip")

The URL can only narrow the query, never widen it:

• Values in the command take precedence. For a field the command filters on, request takes over neither values nor filter_op/filter_mode – ?filter[area]=internal or ?filterop[area]=!= change nothing about filter[area]=articles. Fields of a linked record count as the reference field (author.name belongs to author); area and area_id count as the same field.
• skip, limit, sort and order from the command replace the URL value completely. limit from the URL only counts as a positive number – “unlimited” cannot be requested.
• Encrypted fields only find the exact value; wildcards (*) and greater/less yield no hits.
• Password fields can never be filtered or sorted.

← Overview

CMS:SELECT_LANGVERSION

Returns the available languages as records.

(CMS:SELECT_LANGVERSION resulttemplate)

Method: Cms::cmsSelectLanguages()
Without key: the first value without = is the resulttemplate
PHP snippet: push_result (before) · include, pop_result (after)

Parameters

¹ can be given without a key as the first value.

Usage

Provides the languages of the website as a result set – main language first – and includes the resulttemplate. Each row contains language_id, code, label, endonym and current (1 = language of the current call). This creates a language switcher:

<ul class="lang">
(CMS:SELECT_LANGVERSION lang_item)
</ul>

List template lang_item:

(CMS:RESULT_START)
<li<?php if ($cms['current']) echo ' class="active"'; ?>>
  <a href="(CMS:URL lang="{$cms['code']}")" hreflang="(CMS:TEXT code)">(CMS:TEXT endonym)</a>
</li>
(CMS:RESULT_END)

The rows are not records; CMS:URL without id therefore points to the outer record – the record of the page or the row of the surrounding result loop – only in the respective other language. If the field slug is multilingual, CMS:URL inserts the slug of the target language (/de/esstisch-nord-180 → /en/dining-table-nord-180), see CMS:URL. With only one language, the result set contains exactly one row.

On a page without a record (stand-alone template, /de/0,suche) there is no outer record; the template must then be specified explicitly in the link:

<a href="(CMS:URL lang="{$cms['code']}" template=suche)">(CMS:TEXT endonym)</a>

Parameters in detail

resulttemplate

List template; may be given without a key:

(CMS:SELECT_LANGVERSION resulttemplate=lang_item)
(CMS:SELECT_LANGVERSION lang_item)

← Overview

CMS:RESULT_START

Marks the beginning of a loop for processing CMS:SELECT results.

(CMS:RESULT_START)

No method call – the effect lies solely in the PHP snippet
PHP snippet: loop_start (after)

Parameters

This command has no parameters.

Usage

Opens the loop over the hits of a CMS:SELECT (or CMS:SELECT_LANGVERSION, CMS:USER_BASKET function=load). It belongs in the list template; everything between CMS:RESULT_START and CMS:RESULT_END is executed for each hit, and the commands in it read from the current row:

<table>
(CMS:RESULT_START)
<tr>
  <td><?php echo $this->cms->row_no + 1; ?></td>
  <td><a href="(CMS:URL)">(CMS:TEXT title)</a></td>
  <td>(CMS:DATE online_at)</td>
</tr>
(CMS:RESULT_END)
</table>

Within the loop, the following are available: $cms (the current row as an array), $this->cms->row_no (zero-based row number), $this->db->num_rows (hits on this page) and $this->db->num_rows_unlimited (total number with count=true).

The command has no parameters and creates no method call – it is compiled directly into a for loop.

← Overview

CMS:RESULT_END

Marks the end of a loop for processing CMS:SELECT results.

(CMS:RESULT_END)

No method call – the effect lies solely in the PHP snippet
PHP snippet: loop_end (after)

Parameters

This command has no parameters.

Usage

Closes the loop opened with CMS:RESULT_START:

(CMS:RESULT_START)
  <li>(CMS:TEXT title)</li>
(CMS:RESULT_END)

Every CMS:RESULT_START needs exactly one CMS:RESULT_END in the same template – the compiler turns them into { and }; a missing end leads to a PHP syntax error when the page is called.

← Overview

CMS:JUMP_LIST

Creates a page navigation (pagination), for example 1 … 5 | 6 | 7 | 8 | 9 … 15.

(CMS:JUMP_LIST separator [parameter=value …])

Method: Pagination::cmsJumpList()
Without key: the first value without = is the separator

Parameters

¹ can be given without a key as the first value.

Usage

Page navigation for a CMS:SELECT with count=true. The page size is the limit of the query; without limit there are no pages and the command outputs only ifempty. The current offset comes from $_REQUEST['skip'].

The command stands in the resulttemplate of the CMS:SELECT (before or after the result loop): only there the hit count and limit of this query apply – after the CMS:SELECT in the calling template, the outer result is active again.

(CMS:SELECT list filter[area]=articles limit=20 skip="{$_REQUEST['skip']}" count=true)

Template list:

(CMS:RESULT_START)
  <h2>(CMS:TEXT title)</h2>
(CMS:RESULT_END)
<nav class="pager">
(CMS:JUMP_PREV) (CMS:JUMP_LIST separator=" | ") (CMS:JUMP_NEXT)
</nav>

Output: ❮❮ 1 … 5 | 6 | 7 | 8 | 9 … 15 ❯❯

The links keep all other parameters of the current URL (search term, filters) and only set skip anew. If the result fits on one page, nothing is output (or ifempty).

Bootstrap-style bar:

(CMS:JUMP_LIST
  prefix="<ul class=pagination>" suffix="</ul>"
  tpl_link="<li><a href='{href}'>{page}</a></li>"
  tpl_active="<li class=active><span>{page}</span></li>"
  ellipsis="<li class=disabled><span>…</span></li>"
  separator=""
)

Parameters in detail

skip

Offset of the current page, if it does not come from $_REQUEST['skip']:

(CMS:JUMP_LIST skip="{$offset}")

maximum

Number of moving page links (not counting the first and last page):

(CMS:JUMP_LIST maximum=5)

Output on page 7 of 15: 1 … 5 6 7 8 9 … 15

boundaries

Suppress links to the first and last page:

(CMS:JUMP_LIST boundaries=false)

Output: 5 6 7 8 9 instead of 1 … 5 6 7 8 9 … 15

separator

Text between two page links; may stand without a key:

(CMS:JUMP_LIST " | ")
(CMS:JUMP_LIST separator=" · ")

tpl_link

Template for each page link; {href} and {page} are replaced:

(CMS:JUMP_LIST tpl_link="<a class=page href='{href}'>{page}</a>")

tpl_active

Template for the current page:

(CMS:JUMP_LIST tpl_active="<span class='page current'>{page}</span>")

ellipsis

Placeholder for omitted pages (between the first/last page and the moving range):

(CMS:JUMP_LIST ellipsis=" ··· ")

replace

Simple replacement in the finished HTML, separator ? (only one pair):

(CMS:JUMP_LIST replace="<strong>?<strong class=current>")

prefix

Appears only if a navigation is output:

(CMS:JUMP_LIST prefix="<nav class=pager>" suffix="</nav>")

suffix

(CMS:JUMP_LIST suffix="</nav>" prefix="<nav>")

ifempty

Output if everything fits on one page (or the CMS:SELECT has no limit):

(CMS:JUMP_LIST ifempty="<span class=muted>all entries</span>")

set

(CMS:JUMP_LIST set=pager)
<?php if ($set['pager'] !== '') { ?><nav><?php echo $set['pager']; ?></nav><?php } ?>

← Overview

CMS:JUMP_NEXT

Creates a link to the next page.

(CMS:JUMP_NEXT tpl_link [parameter=value …])

Method: Pagination::cmsJumpNext()
Without key: the first value without = is the tpl_link

Parameters

¹ can be given without a key as the first value.

Usage

Link to the next page of a pageable list (CMS:SELECT with count=true and limit). Like CMS:JUMP_LIST, the command stands in the resulttemplate of the query, here with limit=20:

(CMS:JUMP_PREV) Page <?php echo intdiv((int)($_REQUEST['skip'] ?? 0), 20) + 1; ?> (CMS:JUMP_NEXT)

Output: ❮❮ Page 3 ❯❯

If there is no next page – also when everything fits on one page –, tpl_inactive appears (default: the symbol without a link). The page size is the limit of the CMS:SELECT; without limit, only ifempty appears.

Parameters in detail

skip

(CMS:JUMP_NEXT skip="{$offset}")

tpl_link

Template with link; {href} is replaced. May stand without a key:

(CMS:JUMP_NEXT "<a class=next href='{href}'>next ›</a>")

tpl_inactive

Template without a next page ({href} is replaced here too – with the address the next page would have):

(CMS:JUMP_NEXT tpl_link="<a href='{href}'>next ›</a>" tpl_inactive="<span class=disabled>next ›</span>")

replace

(CMS:JUMP_NEXT replace="❯❯?→")

prefix

(CMS:JUMP_NEXT prefix="<li class=next>" suffix="</li>")

suffix

(CMS:JUMP_NEXT suffix="</li>" prefix="<li>")

ifempty

(CMS:JUMP_NEXT ifempty="")

Applies only if the CMS:SELECT has no limit; the default is empty.

set

(CMS:JUMP_NEXT set=next)

← Overview

CMS:JUMP_PREV

Creates a link to the previous page.

(CMS:JUMP_PREV tpl_link [parameter=value …])

Method: Pagination::cmsJumpPrev()
Without key: the first value without = is the tpl_link

Parameters

¹ can be given without a key as the first value.

Usage

Link to the previous page – the counterpart to CMS:JUMP_NEXT, which, like it, stands in the resulttemplate of a CMS:SELECT with limit (the limit is the page size):

<nav>(CMS:JUMP_PREV "<a href='{href}'>‹ previous</a>" tpl_inactive="") (CMS:JUMP_NEXT "<a href='{href}'>next ›</a>" tpl_inactive="")</nav>

On the first page, tpl_inactive appears (here empty), otherwise the link – also when everything fits on one page.

Parameters in detail

skip

(CMS:JUMP_PREV skip="{$offset}")

tpl_link

(CMS:JUMP_PREV "<a class=prev href='{href}'>‹ previous</a>")

tpl_inactive

(CMS:JUMP_PREV tpl_inactive="<span class=disabled>‹ previous</span>")

replace

(CMS:JUMP_PREV replace="❮❮?←")

prefix

(CMS:JUMP_PREV prefix="<li class=prev>" suffix="</li>")

suffix

(CMS:JUMP_PREV suffix="</li>" prefix="<li>")

ifempty

(CMS:JUMP_PREV ifempty="")

Applies only if the CMS:SELECT has no limit; the default is empty.

set

(CMS:JUMP_PREV set=prev)

← Overview

CMS:CONTINUE

Continues template processing despite a success template.

(CMS:CONTINUE)

Method: Cms::cmsContinue()

Parameters

This command has no parameters.

Usage

Commands with successtemplate (CMS:USER_LOGIN, CMS:USER_LOGIN_CODE, CMS:USER_INPUT, CMS:USER_REGISTER, CMS:USER_REGISTER_CONFIRM, CMS:USER_PW, CMS:USER_DELETE, CMS:EMAIL) include their template in case of success and then end the page; likewise CMS:USER_PROTECT and CMS:USER_PW with their errortemplate, and CMS:USER_LOGIN with the codetemplate. If CMS:CONTINUE stands before the command, the template continues to run after the included template instead:

(CMS:CONTINUE)
(CMS:USER_INPUT
  container=comments
  submit="$submit"
  successtemplate=comment_saved
)
<h2>All comments</h2>
(CMS:SELECT comment_list
  filter[area]=comments
)

Without CMS:CONTINUE, nothing would be output after comment_saved – with it, the confirmation appears above the list. The flag applies exactly once: the next of these commands that actually includes a template uses it up.

← Overview

CMS:CSP

Changes the script policy (Content Security Policy) of this page: additional script sources, form targets or a different mode.

(CMS:CSP [parameter=value …])

Method: Cms::cmsCsp()

Parameters

Usage

For each website, a script policy can be switched on in the back end (instance, section “Script policy (CSP)”). Then only scripts run that

• carry the nonce of the page (a random value for each request) – in the template, write <script(CMS:NONCE)> for this, see CMS:NONCE, or
• are loaded from your own website or from the listed sources (<script src="/js/app.js">).

Code that gets into the page through content (a comment with <script>, an image with onerror) carries no nonce and does not run. The default is “off”; “Report only” lets everything run and writes violations to the log csp – so you can see what would be blocked before you enforce the policy.

CMS:CSP adapts the policy for one page, for example the checkout with the script of the payment provider:

(CMS:CSP script="https://js.stripe.com" form="https://checkout.stripe.com")

The command must come before the first output, ideally at the very top of the template; if it comes later or mode is unknown, it stores an error message (CMS:MESSAGE). Several calls collect sources, separated by spaces or commas. Host specifications are allowed (https://js.example.com, *.example.com, with port or path); keywords such as 'unsafe-inline' and bare schemes such as https: are discarded – they would override the policy.

What the policy blocks and how to do it correctly:

When you save a template, the editor reports every <script> without (CMS:NONCE), every on…= attribute and every javascript: as a note; on the start page, the widget “Template messages” collects them – also for templates that are edited in the file system.

If you want a completely custom policy (also for styles, images, connections), send it with CMS:HEADER and get the nonce with (CMS:NONCE format=value).

Parameters in detail

script

(CMS:CSP script="https://maps.example.com https://cdn.example.com")

form

(CMS:CSP form="https://www.paypal.com")

mode

Temporarily exempt a page with an old widget or let it only report:

(CMS:CSP mode=report)
(CMS:CSP mode=off)

← Overview

CMS:HEADER

Sends an HTTP header.

(CMS:HEADER text [parameter=value …])

Method: Cms::cmsHeader()
Without key: the first value without = is the text

Parameters

¹ can be given without a key as the first value.

Usage

Sends an HTTP header. It must come before the first output – so at the beginning of the template, before any HTML and without a blank line in front:

(CMS:HEADER "Content-Type: application/json; charset=utf-8")
{"title": (CMS:TEXT title specialchars=true lbrconvert=false prefix='"' suffix='"')}

Further typical cases:

(CMS:HEADER "Content-Type: application/rss+xml; charset=utf-8")
(CMS:HEADER "Cache-Control: no-store")
(CMS:HEADER "HTTP/1.1 404 Not Found")

Redirect – CMS commands cannot be nested within each other, so the address is first passed to $set with set and then placed into the header:

(CMS:URL id=home set=target)
(CMS:HEADER "Location: {$set['target']}")

If a template delivers CSS, JavaScript or JSON, the matching Content-Type belongs at the beginning – camindo CMS sends X-Content-Type-Options: nosniff, so the browser does not execute a script with the default type text/html:

(CMS:HEADER "Content-Type: text/javascript; charset=utf-8")

If something has already been output, an error message is stored (CMS:MESSAGE) and the header is not sent.

Parameters in detail

text

The header line; may be given without a key:

(CMS:HEADER text="X-Robots-Tag: noindex")
(CMS:HEADER "X-Robots-Tag: noindex")

overwrite

By default, a header replaces a previous header of the same name; overwrite=false adds another one:

(CMS:HEADER "Link: </style.css>; rel=preload; as=style")
(CMS:HEADER "Link: </app.js>; rel=preload; as=script" overwrite=false)

Replacing or removing the defaults

camindo CMS sends some security headers before the template:

X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: private, no-cache

This means the page may only be placed in a frame within the website itself (background information: Basics). Each of these headers can be replaced; without a value, it is removed. A page that a partner may embed:

(CMS:HEADER "X-Frame-Options:")
(CMS:HEADER "Content-Security-Policy: frame-ancestors 'self' https://partner.example")

If a script policy is switched on for the website (back end, instance), camindo sends script-src 'self' 'nonce-…' together with frame-ancestors 'self' instead; for individual pages, adapt it with CMS:CSP.

A custom Content-Security-Policy replaces the default – then include frame-ancestors as well (the nonce of the page is provided by CMS:NONCE):

(CMS:HEADER "Content-Security-Policy: frame-ancestors 'self'; script-src 'self' https://cdn.example")

Caching

Pages are generated anew on every request. With the default Cache-Control: private, no-cache, no proxy and no CDN stores the page, and the browser asks the server again before every display – changed content appears immediately. The browser's back button stays fast all the same.

If a page belongs to a single visitor – a session of a frontend user is running (also a basket without sign-in, see CMS:USER_BASKET) or frontend editing is switched on – camindo sends Cache-Control: private, no-store instead: the page is not stored anywhere.

A page that rarely changes may be cached longer:

(CMS:HEADER "Cache-Control: public, max-age=3600")

Put the header at the top of the template. If a CMS:USER_* command with a session runs afterwards, private, no-store applies again – so personal pages never end up in a cache.

← Overview

CMS:INCLUDE

Includes a template.

(CMS:INCLUDE template)
(CMS:INCLUDE template caching=5m cacheparams=$params)

Method: Cms::cmsInclude()
Without key: the first value without = is the template
PHP snippet: include_cached (after)

Parameters

¹ can be given without a key as the first value.

Usage

Includes another template at this point – for header and footer areas, navigation, recurring blocks:

(CMS:INCLUDE header)
<main>
  <h1>(CMS:TEXT title)</h1>
  (CMS:INCLUDE text_image_block)
</main>
(CMS:INCLUDE footer)

The included template sees the same record ($cms), the same $set values and, within a result loop, the same row. A name without an area must be unique within the access area of the instance, otherwise use area.name:

(CMS:INCLUDE templates.header)

The nesting depth is limited by admin.max_include_depth (default 20) – a template that includes itself aborts with an error message.

Parameters in detail

template

Name or area.name (no id); may be given without a key. In the back-end editor, the value is a link to the template:

(CMS:INCLUDE template=header)
(CMS:INCLUDE header)
(CMS:INCLUDE templates.header)
(CMS:INCLUDE "{$set['layout']}")        dynamic

set

The output of the included template ends up in $set instead of on the page – for example to use a block twice or to pass it on to another command:

(CMS:INCLUDE price set=price)
<p class="price"><?php echo $set['price']; ?></p>
<meta property="product:price" content="(CMS:TEXT useval="{$set['price']}" striptags=true specialchars=true)">

With caching, the intercepted text also comes from the cache.

caching

Switches on the output cache for this call: the first time, the template runs as usual, and its output is stored under var/cache/include/. Every further call with the same parameters delivers this file within the time limit – the template, its queries and included templates then do not run.

(CMS:INCLUDE navigation caching=1h)
(CMS:INCLUDE footer caching=1d)
(CMS:INCLUDE teaser caching="{$set['cache_time']}")

An invalid value (caching=5x) appears as an error message; the template then runs without a cache.

cacheparams

The cache distinguishes by website and language on its own. If the output depends on further things – the record, the page of a list, a filter, the signed-in customer –, they belong in cacheparams. Each other value creates its own cache file.

Permitted are null, true/false, numbers, texts and arrays. A variable without quotation marks is passed unchanged, including an array:

<?php $params = ['id' => $cms['record_id'], 'page' => (int)($_GET['skip'] ?? 0)]; ?>
(CMS:INCLUDE product_list caching=10m cacheparams=$params)
(CMS:INCLUDE product_box caching=1h cacheparams=$cms['record_id'])
(CMS:INCLUDE product_box caching=1h cacheparams="product-{$cms['record_id']}")

Arrays are compared as a whole – the same keys in a different order produce a different cache file.

What the cache takes into account

• If the included template is changed, its cache files immediately no longer apply. If content changes in the back end, however, visitors see it only after the time limit has expired. Choose the time limit according to how quickly changes must become visible.
• A template that itself includes templates stores their output with it. If such an inner template changes, the cached output remains until the time limit expires.
• Only the output is stored. What the template otherwise does – setting values in $set, CMS:HEADER, CMS:CSP, cookies, emails – does not happen on a cache hit. Such commands belong in the calling template.
• The nonce of the script policy (CMS:NONCE) is the current one in every delivery.
• Do not cache forms with security tokens (CMS:USER_TOKEN, CMS:USER_INPUT) and personal content of signed-in customers – or include the customer in cacheparams.
• If a command reports an error while generating the output, the output is not stored.
• In the preview from the back end and when frontend editing is switched on, no cache applies.
• If many visitors call an expired template at the same time, only one of them generates it; the others wait briefly and then get the result.

Expired files are cleaned up by the scheduler task “Clean up frontend cache”; the cache is emptied completely with php Core/cron/camindo.php cache include. The system administrator sets up both.

← Overview

CMS:NONCE

Outputs the nonce of the page – for every script in the template.

(CMS:NONCE [parameter=value …])

Method: Cms::cmsNonce()

Parameters

Usage

If the script policy of the website is enforced (see CMS:CSP), only scripts with the nonce of the page run – a random value that changes with every request. Therefore, write every script in the template like this:

<script(CMS:NONCE)>
document.querySelectorAll('[data-confirm]').forEach(function (form) {
  form.addEventListener('submit', function (ev) {
    if (!confirm(form.dataset.confirm)) ev.preventDefault();
  });
});
</script>

Included files get it as well if they do not come from your own website:

<script src="https://cdn.example.com/lib.js"(CMS:NONCE)></script>

camindo CMS does not add the nonce by itself. If it is missing, the template editor reports a note when you save (“script without (CMS:NONCE)”), as does the widget “Template messages” on the start page. As long as the script policy is off, the attribute does no harm – nevertheless, add it right away, so the policy can be switched on later without changing the templates.

onclick="…", onsubmit="…" and href="javascript:…" do not run under the policy at all, not even with a nonce: move the code into a <script(CMS:NONCE)> with addEventListener (example above).

If PHP generates the tag, get the nonce with set:

(CMS:NONCE set=nonce)
<?php echo '<script' . $set['nonce'] . '>var shop = ' . json_encode($config) . ';</script>'; ?>

For a custom policy via CMS:HEADER:

(CMS:NONCE format=value set=nonce)
(CMS:HEADER "Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{$set['nonce']}'")

A page that a proxy or cache delivers with a fixed nonce no longer offers protection – do not cache pages with a script policy as a whole.

Parameters in detail

format

<script(CMS:NONCE)>…</script>
(CMS:NONCE format=value)

set

(CMS:NONCE set=nonce)

← Overview

CMS:SAVEDATA

Stores the data of the current record in the specified variable.

(CMS:SAVEDATA phpvar [parameter=value …])

Method: Cms::cmsSaveData()
Without key: the first value without = is the phpvar

Parameters

¹ can be given without a key as the first value.

Usage

Stores a complete record as an array in a global PHP variable – for logic that cannot be written with the output commands alone:

(CMS:SAVEDATA article)
<?php if ($article['price'] > 100 && $article['stock'] > 0) { ?>
  <span class="badge">Premium</span>
<?php } ?>

With id, load a different record, for example the parent node, in order to calculate with its values:

(CMS:SAVEDATA parent id="{$cms['parent_id']}")
<?php if ($parent['price'] > $cms['price']) { ?> … <?php } ?>

If you only need to output fields of another record, you do not need CMS:SAVEDATA – the output commands read with id themselves: