Good catch and that's definitely true as well but there's no way the author could have passed an ampersand into a Go string (ie as a parameter in said tool) without understanding the need to escape it in the first place. The shell would have parsed the ampersand as a reserved token out before the URI encoding bug was exposed.
As first project though, it's a great learning exercise for the author. We all have to start somewhere.
As first project though, it's a great learning exercise for the author. We all have to start somewhere.