Escape with CGI::escape instead of URI.escape

Since URI.escape does not percent encode [and is deprecated], everything after a string that contains an ampersand is lost.