The ampersand (&) is a special character for XML, so you likely need to encode it into the appropriate XML entity:

$link =~ s/&/&/g;
[download]

But somewhere down the road, you will encounter other problematic characters in URLs, like <, > and maybe others. So you could use XML::RSS to generate your RSS, or use HTML::Entities to encode all your URLs.