The result of self_url is already URI-escaped, but if you're feeding it as HTML, you need to additionally HTML-entitize it.

use HTML::Entities;
my $url = encode_entities(CGI->self_url());
print qq{<a href="/path/to/new/location.pl?URL=$url">new location</a>}
+;
[download]

-- Randal L. Schwartz, Perl hacker