I noticed while validating the HTML output of an extension that some urls are being generated with a plain & instead of encoded as & and the W3C validator complains about this as an error. This patch fixes the line of code that was the source of the uncoded ampersand (and another line I noticed) if anyone with CVS access chooses to apply it.