In theory, you have to HTML-escape tag attributes. I'm guessing your actual URL does contain more "weird" characters than the example URL you gave here.

Oh, and despite what other people have been saying here, you should put quotes around the attribute. Though browsers are very lax, if an attribute contains even slightly offbeat characters (such as a slash or a colon), attribute parsing may stop right there, and you get an incomplete URL.