If the source of $domain is trusted, interpolation is fine because the domain can't contain any character that need escaping. That's not the case for $class, $user and $function. If they're untrusted or if they can contain most of anything other than letters and digits, they need to be escaped.

Here's a solution using URI.

use URI qw( );

my $url = URI->new("http://$domain:2087");
$url->path_segments('xml-api', $class);
$url->query_form( user => $user, $function => 1 );

print "$url\n";
[download]

Or if you don't trust $domain,

use URI qw( );

my $url = URI->new('', 'http');
$url->host("$domain:2087");
$url->path_segments('xml-api', $class);
$url->query_form( user => $user, $function => 1 );

print "$url\n";
[download]