I would suggest building the entire query string first and then escaping the entire thing. That way you don’t need to guess what needs to be escaped and what doesn’t.
For testing, using curl or wget will give you much more transferable results because browsers will add their own escaping before sending a request.
Tom