<a href="@url@">
rather than
<a href="@url;noquote@">
? As far as I can see we still need to encode the &'s.