You're re-requesting the page via header location. & is defined as the querystring separator, so it considers the next half to be that of a new variable. Use urlencode() on the values prior to sending them. Alternatively, use http_build_query and give it an array and it will automatically issue the urlencode.
header('HTTP/1.1 420 Enhance Your Calm');