We have a problem related to the escaping of the & in the password reset URL not being escaped. This link:


somehow, this arrives at our server as:


Then the code is abcd and a parameter called amp;id is 1234, and the error "Bad Request Param "id" doesn't exist." is thrown.

In our case, we have craft setup to send HTML emails, and have an email template like:

Click here to reset your password: {{link}}

and end up with the link http://yoursite/admin/actions/users/setpassword?code=abcd&id=1234 directly in the HTML - this is WRONG, since the & symbol has to be escaped as &.

Now, we could compensate, and make our template:

Click here to reset: {{link|escape}}

Then we get correct HTML, but the plain-text version of the email is now broken.

Is there no way to have separate templates for text and html emails in craft?

How do other people solve this?

1 Answer 1


Is there no way to have separate templates for text and html emails in craft?

Correct. That's something we're going to try to address in Craft 3.

Regarding the ampersand encoding, I can't reproduce that locally. Maybe your email client is encoding it or there is an overly aggressive mod_security / Suhosin / Apache setting that's doing it?

  • If there's any way you can move up giving email template capabilities some love...I have a membership site where every interaction - member activation, reset password, etc - by email requires copying and pasting a link. Dec 9, 2015 at 20:49
  • I'm having this issue with 2 out 96 users (so far). Is {{link|escape}} the recommended workaround? Jan 23, 2018 at 0:11
  • We're using Craft 3 and have a client with the same issue. At present, their customers are having to copy and paste the link to avoid the 'Bad Request' message. Is there a solution to this?
    – GazCrane
    Oct 26, 2021 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.