Your code (where you build the URL) is most likely correct (I guess the above has some typos?!), but when you display the URL in a label for instance, the & character is treated as indicator for an accelerator key.
By Windows design, accelerator keys
enable the user to access a menu
command from the keyboard by pressing
Alt along the appropriate letter,
indicated in your code by the
preceding ampersand (&). The character
after the and sign (&) appears
underlined in the menu.
If you want to display the & character itself, you have to set your string variable to &&.
By placing two ampesands together - you state that the character following the first one is not used as the accelerator - rather you actually want to get it (only one) displayed.
Just use your debugger if you want to see the real value that your string variables have, don't output them to a message box or the like... It may have side effects, as you can see.
Regarding the URL you build: I can't possibly know how it has to be correctly, but at least you should use the right slashes!
s := 'http://site.com...'
(All quotes from delphi.about.com)