We have a problem related to the escaping of the & in the password reset URL not being escaped. This link:


somehow, this arrives at our server as:


Then the code is abcd and a parameter called amp;id is 1234, and the error "Bad Request Param "id" doesn't exist." is thrown.

In our case, we have craft setup to send HTML emails, and have an email template like:

Click here to reset your password: {{link}}

and end up with the link http://yoursite/admin/actions/users/setpassword?code=abcd&id=1234 directly in the HTML - this is WRONG, since the & symbol has to be escaped as &.

Now, we could compensate, and make our template:

Click here to reset: {{link|escape}}

Then we get correct HTML, but the plain-text version of the email is now broken.

Is there no way to have separate templates for text and html emails in craft?

How do other people solve this?


Is there no way to have separate templates for text and html emails in craft?

Correct. That's something we're going to try to address in Craft 3.

Regarding the ampersand encoding, I can't reproduce that locally. Maybe your email client is encoding it or there is an overly aggressive mod_security / Suhosin / Apache setting that's doing it?

  • If there's any way you can move up giving email template capabilities some love...I have a membership site where every interaction - member activation, reset password, etc - by email requires copying and pasting a link. Dec 9 '15 at 20:49
  • I'm having this issue with 2 out 96 users (so far). Is {{link|escape}} the recommended workaround? Jan 23 '18 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.