nslookup on Debian cheerfully decoded those URLs with ampersands, while the SamSpade site did not. We should keep in mind that the definition of "valid" is not "the behavior of some random app as coded by some random programmer", but instead (as Ben indicates) what the RFC says. Unless it's a MicroSoft app... ;->