Properly escape URLs when replacing query parameter