URL placeholders broken by CGI escapes

This commit fixes placeholders which broke in 08c3c0560c6a3d2f8a0404f8d986953ac7330874.