When hitting the "forgot password" link on the CP login form, an email is sent but the URL provided returns "Bad Request Param "id" doesn't exist."

Is this a bug or have I done something silly?

This is a site running on a local development environment with Craft 2.3.2636

  • Can you enable devMode, reproduce the issue, then immediately zip up your craft/storage/runtime/logs folder and send it to [email protected]?
    – Brad Bell
    Mar 4, 2015 at 19:45

1 Answer 1


I know why this happens - we have the same problem. It is related to the escaping of the & in the password reset URL not being escaped:


somehow, this arrives at our (and your I guess) server as:


Then the code is abcd and a parameter called amp;id is 1234.

In our case, we have craft setup to send HTML emails, and have an email template like:

Click here to reset your password: {{link}}

and end up with the link http://yoursite/admin/actions/users/setpassword?code=abcd&id=1234 directly in the HTML - this is WRONG, since the & symbol has to be escaped as &.

Now, we could compensate, and make our template:

Click here to reset: {{link|escape}}

Then we get correct HTML, but the plain-text version of the email is now broken.

AFAIK there is no way to have separate templates for text and html emails in craft?

I guess your problem is also HTML emails, OR you have a user with an overzealous email client, that adds the escape of the & for you.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.