by Tim Hunt.
Acutally, your problem is with moodle_url. If you don't want escaping, you have to use $url->out(false);
$url->__toString(); (which is what your string concatenation will call) does $url->out(true);