How do you fill $url?

If it is extracted from a HTML document it may be html encoded, so you won't find a literal '&&'; maybe a '&&'.

It's hard to guess without knowing further details (Data source, script context, ...).