Is there a way to set skin url to be unsecure in img tag in email template content at the Magento backend.

My tag would be:

<img src="{{skin url="images/registration-email/logo.jpg" _area="frontend" _package="xyz"}}" />

2 Answers 2



This is one of those instances where PHP loose-typing was not handled carefully. If you look at the implementation of Mage_Core_Model_Design_Package::getSkinUrl, which is what the {{skin url...}} CMS directive invokes, you will see that it makes use of a method named getSkinBaseUrl that builds the URL. That method determines whether to make it secure like this:

isset($params['_secure'])? (bool)$params['_secure'] : null

When you cast a string to a boolean in PHP, certain rules apply to how it will be converted. These are values that will be converted to FALSE:

  • the boolean FALSE itself
  • the integer 0 (zero)
  • the float 0.0 (zero)
  • the empty string, and the string "0"
  • an array with zero elements
  • an object with zero member variables (PHP 4 only)
  • the special type NULL (including unset variables)
  • SimpleXML objects created from empty tags

Every other value is considered TRUE.

Since (bool)"false" === TRUE, and they make that clear in the examples in the linked documentation, it’s only a happy accident that the XML param _secure="true" causes URLs to use https. Normally this is fine because we typically use this param to force a URL to be secure, but in this case we are doing the opposite. You could put nearly any string value in that param and it would create a secure URL, which leads me to...


This will allow you to force a URL in a CMS directive to be unsecure:

{{skin url="..." _secure="0"}}

add _secure="false" and then try. ie

<img src="{{skin url="images/registration-email/logo.jpg" _area="frontend" _package="xyz" _secure="false"}}" />

Don't forget to clear cache after the changes made.

  • 1
    Ya i tried this but it isnt working.
    – Swetha
    Commented Sep 18, 2015 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.