URL gets generated with & instead of & [closed]

I try to setup SAML authentication in my application but I'm facing a URL

My generated URL to SimpleSAML contains & instead of & and SimpleSAML doesn't like it

Here is my piece of code that does the redirection. If I print the $url var, it's all good. For some reasons that I don't understand, my browser (or apache, or whatever) does the change from & to &

Do you have some clues about it ?

if (!headers_sent()) {
            // set the location header
            header('Location: ' . $url, true, $code);

            // disable caching of this response
            header('Pragma: no-cache');
            header('Cache-Control: no-cache, no-store, must-revalidate');
        }