Dynamic Forms Builder for Magento 2

What you get

Magento 2 Dynamic Forms

Dynamic Forms lets a store administrator build custom forms in the Magento admin, publish them as standalone pages or embed them with a widget, and review the submissions in an admin grid. Each form has its own fields, success message, redirect URL, notification email and optional auto-reply. Submissions are stored in the database and can be filtered, annotated and given a status.

The module ships two storefront templates: one for Hyva (Alpine.js) and one for Luma (jQuery). The active theme is detected through Panth_Core and the matching template is chosen automatically.

Product page: kishansavaliya.com/magento-2-dynamic-forms.html

Features

• Form builder in the admin with drag-and-drop reordering of fields.
• 13 field types: Text, Textarea, Email, Phone, Number, Dropdown (Select), Multi-Select, Checkbox, Radio Buttons, File Upload, Date, Hidden and WYSIWYG Editor.
• Per-field label, name, placeholder, default value, required flag, CSS class, width (Full Width, Half Width, One Third Width), options for choice fields and validation rules in JSON.
• Server-side validation of required fields, email format, phone format, numeric values, choice fields against their configured options, a 65535-character limit per value, and the JSON rules min_length, max_length, min, max, pattern and pattern_message.
• Three placement modes per form: "Standalone Page (has its own URL)", "Widget Only (embed on CMS pages/blocks)" or "Both (standalone page + widget)".
• Standalone pages are served at /pages/<url_key> by a custom router, with per-form Meta Title, Meta Description, Meta Keywords, Meta Robots, a canonical link and JSON-LD (WebPage with a ContactPage entity).
• A "Dynamic Form" widget for CMS pages and blocks, with the equivalent {{widget}} directive for the WYSIWYG editor.
• CMS content above and below the form, passed through the CMS page filter so directives and widgets work.
• AJAX submission with inline field errors, a success message or a redirect URL.
• File uploads through an AJAX endpoint with an allowed-extension list, a maximum size, a content-type check, and a hard deny-list from Panth_Core for executable extensions.
• Submissions stored in the database with the customer id, email, name, IP address, store id and a status (New, Read, Replied, Closed).
• Admin notification email per form with CC and BCC, and an optional auto-reply to the submitter with placeholders for the name, email, form name and store name.
• Spam protection: a honeypot field and a content guard that silently drops submissions containing link-shortener domains, money-transfer wording, three or more links or a URL in a short field.
• Admin grids for forms (keyword search, filters, mass enable, disable and delete) and submissions (keyword search, filters, mass delete, mass status update) plus a submission detail page with status and internal notes.
• Form key (CSRF) check on every submission.

Usage

Creating a form

1. Open Manage Forms and click "Add New Form".
2. In the General section fill in "Form Name (Admin)", choose the "Form Usage" (standalone page, widget only, or both), and enter a "URL Key" for page forms. Set "Frontend Title", "Description", "Active" and "Store ID" (0 means all store views). A form with a store ID other than 0 is only shown, rendered as a widget, and accepted on submit and upload in that store view.
3. Optionally add "Content Above Form" and "Content Below Form" (WYSIWYG, CMS directives allowed).
4. In Form Settings set "Submit Button Text", "Success Message" and an optional "Redirect URL". The redirect URL must be a relative path such as /thank-you or a full http or https URL on one of the store's own domains. Other values, such as javascript: or another site, are refused when saving, and a stored value that does not pass the check is ignored on the storefront.
5. In Email Settings enter "Admin Notification Email" (plus "Admin Email CC" and "Admin Email BCC", comma-separated), and enable "Enable Auto Reply" with "Auto Reply Subject" and "Auto Reply Body" if wanted.
6. In SEO set "Meta Title", "Meta Description", "Meta Keywords" and "Meta Robots" for page forms.
7. In Form Fields add fields, set their type and properties, drag them into order and save.

The URL key is lowercased and reduced to letters, digits, hyphens and underscores. It must be unique among forms and must not collide with an existing URL rewrite. Widget-only forms have no URL key.

Field types

Text, Textarea, Email, Phone, Number, Dropdown (Select), Multi-Select, Checkbox, Radio Buttons, File Upload, Date, Hidden and WYSIWYG Editor. Dropdown, Multi-Select, Checkbox and Radio Buttons take a list of options. Multi-value fields are stored as a comma-separated string. WYSIWYG Editor renders as a textarea on the storefront. The field builder exposes a "Validation Rules (JSON)" box per field; supported keys are min_length, max_length, min, max, pattern and pattern_message.

Placing a form on the storefront

• Standalone page: forms of type page or both are served at /pages/<url_key> on the storefront. The page title, meta tags, canonical link and JSON-LD come from the form's SEO fields.
• Widget: in Content > Pages or Content > Blocks choose Insert Widget, pick the "Dynamic Form" widget type, then set "Select Form", "Show Form Title", "Show Form Description" and "Template" (Default or Hyva).
• Directive: paste the following into any CMS page or block, replacing FORM_ID with the form id shown in the Manage Forms grid.

{{widget type="Panth\DynamicForms\Block\Widget\DynamicForm" form_id="FORM_ID" show_title="1" show_description="1"}}

• Layout XML: the block Panth\DynamicForms\Block\Widget\DynamicForm accepts a form_id argument and picks the theme template itself when no template is set.

The widget renders nothing when the module is disabled, the form is inactive, or the form has no fields.

A widget shows the form title as a heading inside the form card when "Show Form Title" is Yes. The page-level h1 heading and the WebPage JSON-LD are only printed on the standalone page at /pages/<url_key>, never by a widget on another page.

Submissions

Every accepted submission is written to panth_dynamic_form_submission with one row per field in panth_dynamic_form_submission_value. The customer email is taken from the logged-in customer or, for guests, from the first Email field; the customer name from the logged-in customer or from a field labelled "Name", "Full Name" or "Your Name".

Open Form Submissions to see the grid (columns include ID, Customer Name, Customer Email, Status, IP Address and Submitted At) with keyword search (customer name, email, IP address and notes), filters, mass delete and a mass "Update Status" action. "View Submissions" in the Manage Forms grid opens the grid filtered to that form, and the filter is kept while sorting, filtering and paging. The detail page lists every field value, links uploaded files, and lets you change the status (New, Read, Replied, Closed) and save internal notes without leaving the page. There is no export action in this version.

Notification emails

• Admin notification: sent to the form's "Admin Notification Email" (with CC and BCC) using the "Dynamic Forms - Admin Notification" template. It contains the form name, date, customer name, email, IP address, store name and a table of submitted values; uploaded files are not linked; the email says to open the submission in the admin to download them. Nothing is sent when the address is empty.
• Auto-reply: sent when "Enable Auto Reply" is on, "Allow Auto-Replies" is Yes, a customer email is known and the per-recipient and per-IP hourly limits allow it, using the "Dynamic Forms - Customer Auto-Reply" template. The subject and body accept the placeholders {{name}}, {{customer_name}}, {{email}}, {{customer_email}}, {{form_name}} and {{store_name}}. For guests, {{name}} and {{customer_name}} are always "Customer"; the name typed into the form is never repeated in the auto-reply. Logged-in customers get the name on their account.

Email failures are logged and do not block the submission.

File uploads

File Upload fields send the file to dynamicforms/form/upload before the form is submitted. The request must carry the form key, the form_id of an active form and the field_name of an active File Upload field on that form; custom templates that post to the endpoint need to send both. The upload is checked against Panth\Core\Security\UploadExtensionPolicy, "Allowed File Extensions", "Max File Size (MB)" and the detected content type of the file. Files are stored under the configured Upload Directory inside var/ (default var/dynamicforms/uploads, outside the web root) with a random file name, and the submission stores that file name. On submit, the file value must name a file that exists in that directory. Files can only be downloaded from the submission page in the admin ("Download File"), which needs the "Manage Submissions" permission. Submissions saved before 1.2.9 keep their old pub/media link.

Documentation

USER_GUIDE.md walks an administrator through installation, configuration, creating a form, form types, the field builder, field types, email notifications, SEO settings, widgets, managing submissions, styling, theme compatibility and troubleshooting.

Changelog

See CHANGELOG.md.

Compatibility

Composer constraints from composer.json: magento/module-store ^101.0, magento/module-cms ^104.0, magento/module-widget ^101.0, magento/module-email ^101.0, magento/module-backend ^102.0.

Requirements

• Magento Open Source or Adobe Commerce 2.4.4 to 2.4.8
• PHP 8.1, 8.2, 8.3 or 8.4
• mage2kishan/module-core ^1.0.17 (module Panth_Core), installed automatically by Composer
• Magento modules Magento_Store, Magento_Cms, Magento_Widget, Magento_Email and Magento_Backend

Installation

composer require mage2kishan/module-dynamic-forms
bin/magento module:enable Panth_Core Panth_DynamicForms
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

setup:di:compile is only needed in production mode. Check the result with:

bin/magento module:status Panth_DynamicForms

Configuration

Go to Stores > Configuration > Panth Extensions > Dynamic Forms. All settings live under the config path prefix panth_dynamicforms/. Settings can be set at default, website and store view scope unless noted.

General Settings (panth_dynamicforms/general/)

Spam Protection (panth_dynamicforms/spam/)

Blocked submissions are written to the Magento log at info level with the reason, form id, IP address and a short sample of the content.

Email Settings (panth_dynamicforms/email/)

Display Settings (panth_dynamicforms/display/)

Styling (panth_dynamicforms/styling/)

The shipped storefront templates carry their own inline CSS. The per-form "Form Style (JSON)" value is saved with the form but is not applied by the shipped templates either. The Luma template uses the CSS variables --color-primary and --color-primary-darker when the theme defines them.

Admin menu

The module adds a "Dynamic Forms" group to the admin menu provided by Panth_Core, with three entries: "Manage Forms", "Form Submissions" and "Configuration".

Uninstallation

bin/magento module:disable Panth_DynamicForms
composer remove mage2kishan/module-dynamic-forms
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush

The four panth_dynamic_form* tables and their data, the panth_dynamicforms/* rows in core_config_data, and uploaded files under the Upload Directory (default var/dynamicforms/uploads, or pub/media/dynamicforms/uploads for files uploaded before 1.2.9) are not removed. Drop or delete them manually if they are no longer needed.

License

Free and open source under the MIT License. See LICENSE.txt.

Developer Notes

• Module name: Panth_DynamicForms
• Composer package: mage2kishan/module-dynamic-forms (version 1.2.9)
• Namespace: Panth\DynamicForms
• Frontend route: dynamicforms (form/view, form/submit, form/upload); standalone pages are matched by Controller\Router (sort order 60) on the pattern pages/<url_key>
• Admin route: panth_dynamicforms (form/index|new|edit|save|delete|massDelete|massStatus, submission/index|view|delete|massDelete|massStatus|updateStatus)
• Key classes: Block\Widget\DynamicForm (widget block, template selection, anti-spam field injection, getFormConfig(), getFieldsJson()), Helper\Data (config access, sendAdminNotification(), sendAutoReply(), upload paths), Model\Spam\ContentGuard, Model\Form\SaveDataPreparer, Block\Adminhtml\Form\FieldBuilder, UI data providers under Ui\DataProvider
• Custom templates: call $block->getAntiSpamFieldsHtml() inside the <form>; if a template omits it, the block injects the honeypot into the first <form> tag it finds
• Widget id: panth_dynamic_form; email templates: panth_dynamicforms_email_admin_email_template, panth_dynamicforms_email_autoreply_email_template
• Event prefixes: panth_dynamic_form, panth_dynamic_form_field, panth_dynamic_form_submission
• ACL resources: Panth_DynamicForms::main, Panth_DynamicForms::form, Panth_DynamicForms::submission, Panth_DynamicForms::config
• Database tables (etc/db_schema.xml): panth_dynamic_form, panth_dynamic_form_field, panth_dynamic_form_submission, panth_dynamic_form_submission_value. Fields, submissions and values cascade on delete of their parent.
• No plugins, preferences or observers are registered. etc/di.xml declares grid collection virtual types; etc/frontend/di.xml registers the router.
• Unit tests under Test/Unit cover ContentGuard, SaveDataPreparer and the anti-spam field injection.