We have a problem related to the escaping of the & in the password reset URL not being escaped. This link:


somehow, this arrives at our server as:


Then the code is abcd and a parameter called amp;id is 1234, and the error "Bad Request Param "id" doesn't exist." is thrown.

In our case, we have craft setup to send HTML emails, and have an email template like:

Click here to reset your password: {{link}}

and end up with the link http://yoursite/admin/actions/users/setpassword?code=abcd&id=1234 directly in the HTML - this is WRONG, since the & symbol has to be escaped as &.

Now, we could compensate, and make our template:

Click here to reset: {{link|escape}}

Then we get correct HTML, but the plain-text version of the email is now broken.

Is there no way to have separate templates for text and html emails in craft?

How do other people solve this?

1 Answer 1


Is there no way to have separate templates for text and html emails in craft?

Correct. That's something we're going to try to address in Craft 3.

Regarding the ampersand encoding, I can't reproduce that locally. Maybe your email client is encoding it or there is an overly aggressive mod_security / Suhosin / Apache setting that's doing it?

  • If there's any way you can move up giving email template capabilities some love...I have a membership site where every interaction - member activation, reset password, etc - by email requires copying and pasting a link. Commented Dec 9, 2015 at 20:49
  • I'm having this issue with 2 out 96 users (so far). Is {{link|escape}} the recommended workaround? Commented Jan 23, 2018 at 0:11
  • We're using Craft 3 and have a client with the same issue. At present, their customers are having to copy and paste the link to avoid the 'Bad Request' message. Is there a solution to this?
    – GazCrane
    Commented Oct 26, 2021 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.