Hi Toby,It is because you don't use the escapeUrl function, which is mandatory.But please, consider that it is not safe at all to expose in clear the recipient.email to the web, think to hackers exploits and spammers...So you should either use an encrypted/hashed email (by using SHA256), or better, ...