We are finding that Moodle URL activities are changing ampersands inside URLs to "&" with certain settings.

Steps to reproduce -

• Go to a course and create a new "URL" activity
• set the "external URL" value for the activity to be https://a.website.com/index.html?variable1=a&variable2=b
• leave the "appearance" setting as "automatic"
• save
• open the link in a new tab
• the link works as expected
• change the settings for the URL so that it's "appearance" is "new window"
• open the link in a new tab
• the link presented to you on the new tab page has changed to https://a.website.com/index.html?variable1=a&variable2=b

If you open either type of link directly (ie not in a new tab), they work as expected.