Let's escape our URLs and titles here.  esc_url() and esc_html() respectively.  Also, use site_url(), not get_option('siteurl').  Lastly, would prefer add_query_arg() over concatenation.  Escape on the next line as well.