diff --git a/src/mibew/libs/common/csrf.php b/src/mibew/libs/common/csrf.php
index eb554c3b..ce6f6a98 100644
--- a/src/mibew/libs/common/csrf.php
+++ b/src/mibew/libs/common/csrf.php
@@ -69,7 +69,7 @@ function get_csrf_token_in_url()
 {
     set_csrf_token();
 
-    return "&csrf_token=" . $_SESSION['csrf_token'];
+    return "csrf_token=" . $_SESSION['csrf_token'];
 }
 
 /* set csrf token */
diff --git a/src/mibew/styles/pages/default/templates_src/server_side/blocked_visitors.handlebars b/src/mibew/styles/pages/default/templates_src/server_side/blocked_visitors.handlebars
index 3763562f..76db30ea 100644
--- a/src/mibew/styles/pages/default/templates_src/server_side/blocked_visitors.handlebars
+++ b/src/mibew/styles/pages/default/templates_src/server_side/blocked_visitors.handlebars
@@ -56,7 +56,7 @@
                         <td>{{cutString comment "30"}}</td>
 
                         <td>
-                            <a class="removelink" id="i{{banid}}" href="{{../mibewRoot}}/operator/blocked.php?act=del&amp;id={{banid}}{{csrfTokenInUrl}}">
+                            <a class="removelink" id="i{{banid}}" href="{{../mibewRoot}}/operator/blocked.php?act=del&amp;id={{banid}}&amp;{{csrfTokenInUrl}}">
                                 {{l10n "remove.item"}}
                             </a>,
                             <a href="{{../mibewRoot}}/operator/ban.php?id={{banid}}"
diff --git a/src/mibew/styles/pages/default/templates_src/server_side/canned_messages.handlebars b/src/mibew/styles/pages/default/templates_src/server_side/canned_messages.handlebars
index bbfc217f..c47383aa 100644
--- a/src/mibew/styles/pages/default/templates_src/server_side/canned_messages.handlebars
+++ b/src/mibew/styles/pages/default/templates_src/server_side/canned_messages.handlebars
@@ -74,7 +74,7 @@
                         <td>
                             <a href="{{../mibewRoot}}/operator/canned-message/{{id}}/edit" target="_blank"
                                 onclick="this.newWindow = window.open('{{../mibewRoot}}/operator/canned-message/{{id}}/edit', '', 'toolbar=0,scrollbars=1,location=0,status=1,menubar=0,width=640,height=480,resizable=1');this.newWindow.focus();this.newWindow.opener=window;return false;">{{l10n "canned.actions.edit"}}</a>,
-                            <a href="{{../mibewRoot}}/operator/canned-message/{{id}}/delete?lang={{../formlang}}&amp;group={{../formgroup}}{{csrfTokenInUrl}}">{{l10n "canned.actions.del"}}</a>
+                            <a href="{{../mibewRoot}}/operator/canned-message/{{id}}/delete?lang={{../formlang}}&amp;group={{../formgroup}}&amp;{{csrfTokenInUrl}}">{{l10n "canned.actions.del"}}</a>
                         </td>
                     </tr>
                 {{else}}