As linuxer has already noted - and as I suspect due to the name of your variable being '$url' - your input probably contains something other than just plain ampersands ("&"s, most likely.) This is one of those cases where either printing the variable content before you process it or using the Perl debugger (-d) is useful.

If you find yourself actually dealing with individual ampersands, or character-by-character processing of any sort, you should consider using the 'tr///' operator instead of the 's///'; the former is much faster and more efficient, and it's all you need when you're dealing with processing characters rather than strings:

$_ = '&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&';
tr/&/&/s;    # The 's'quash modifier
print;
[download]

The output will be a single '&'.