I echo out the string in a JS console in my browser when troubleshooting. If I take that whole string to an hmac generator site, I can tell that the hash matches with %26, and if I print it from the Perl command line, it matches the hash from an & sign.