Adding the `encodeURIComponent` call here prevents against HTML hijacking during our string building, as well as URL hijacking.