use CGI::Enurl qw(enurl);
my $url = "http://$domain:2087/xml-api/$class?" 
 . enurl({ user => $user, $function => 1});
[download]

If you need to you can encode even the $class but I would assume that one is safe. See CGI::Enurl.