Token Displaying Alphanumeric String, not Email Address

[Anonymous]

Hi everyone,

I have an email preference center landing landing page that is set up to pull in a user's email address into the email form field when they click on theunsubscribe link in an email they've been sent by stripping it out of a parameter in the URL.  The JavaScript for this works perfectly, but the rendering of the email paremeter in the URL is not working as expected.

The URL they click on is coded as <a href="https://info.schoology.com/email-subscription-center.html?Email={{lead.Email Address:default=edit me}}">Unsubscribe</a>.

When the link is clicked though, the resulting URL reads as https://info.schoology.com/email-subscription-center.html?Email=&mkt_tok=[long alphanumeric string]

I'm not sure why it's rendering this way as opposed to putting in the recipient's email address. If you manually edit the URL and type in anything after the "Email=" it does indeed populate the email field.

I would very much appreciate the community's help in determining how to have the actual email address populate in this area.

Thank you very much.

[Josh_Hill13]

Robby,

Why not just use pre-fill on the email field? You do not need to pass the email address as a url param, which is also a big security risk.

Also, you can look at the original code Marketo provides
%mkt_opt_out_prefix%UnsubscribePage.html?mkt_unsubscribe=1&mkt_tok=##MKT_TOK##"

[Anonymous]

Hi Josh,

Thanks for your reply.  Form pre-fill is certainly possible, but there is the potential for error there.  It's possible that a user might have been cookied once before using a different email address than we're sending to.  For example, cookied once with a personal email address, but we're sending to a business email. 

It would be much more preferable to ensure that the email address populated in the form is the email address from which they clicked the unsubscribe link 100% of the time.  Is there a more simple and secure way to accomplish this?

Thank you,
Robby

[Kenny_Elkington]

Hi Robby,

Are you sending this as a test email?  If so, there would not be a lead to populate the email address from.  Try using a sample lead, and it should pull the address from the selected record.

[Anonymous]

Hi Kenny, 

You were correct about the test email.  That's why it was not pulling in the email value.  However, Josh's point about security of displaying this in the URL still does stand.  

Any suggestions on pulling in this value securely from the email address of the recipient (not pre-filled based on cookies, per the potential issues I described above), are greatly appreciated.
 

Thanks,
Robby