Use variable values in redirect links
A redirect can pass a limited result to a destination you control. Keep the destination fixed and treat received values as untrusted input.
Select a screenshot to enlarge it.
Steps
- Define and verify the variable before using it outside the form.
- Inspect the available ending action first. The current REDIRECT_TO selector chooses END OF FORM or SCREEN OUT; it is not a destination-URL input. Confirm the supported ending URL configuration with support before planning a variable redirect.
The current action selects an ending; this selector does not provide a direct destination-URL field. - Only if a supported destination-URL field offers recall, insert the variable value there. Keep the HTTPS domain and path fixed; place only the intended value in a query parameter. A recall picker in question text does not prove that ending URLs support recall.
Choose a supported field from the recall picker rather than inventing a placeholder. - Test spaces, punctuation, a missing value, and the exact final URL. Confirm correct URL encoding.
- Make the receiving application validate the value independently before using it for any consequential action.
Check before you rely on it
Do not put passwords, payment details, API keys, or sensitive answers into redirect URLs. URLs can be retained in browser history and logs.
If you need help
If the current URL field does not support recall or encoding reliably, use a fixed destination and a supported server-side integration instead.
Contact support with the relevant screen, time, and a redacted description. Keep credentials and private respondent information out of screenshots.