$_GET not display character like &

i tried to create a script to redirect link of amazon, but when pass the link in a get variable url not return Url after the character &, i tried to echo the variable $_GET['tolink'] but display a cut url, my code:

$url = $_GET['tolink'];
header("HTTP/1.1 301 Moved Permanently");
header("Location: $url");

when pass the url in a variable thi code redirect to :

https://www.amazon.com/SAMSUNG-50-Inch-Crystal-AU8000-Built/dp/B08Z1RN7NP/ref=sr_1_2?keywords=samsung%20tv

intestead to

https://www.amazon.com/SAMSUNG-50-Inch-Crystal-AU8000-Built/dp/B08Z1RN7NP/ref=sr_1_2?keywords=samsung+tv&qid=1685363216&sr=8-2

i tried also just to var_dump( $_GET['tolink']) and echo cut url, why ?

UPDATE: found a solution, use $_SERVER['QUERY_STRING'] intestead $_GET['tolink'] it's works but is a safe solution ?

A URL may have parameters, like

theurl?param1=val1&param2=val2

so, if you have & inside the value of your URL parameter, it is being mistaken for the separator between URL parameters and this is why it is being cut.

If your URL's tolink parameter was defined in your PHP code, then you can use urlencode, like this

<?php
echo '<a href="someurl?tolink=', urlencode($thelink), '">';
?>

Otherwise, if it was defined at your Javascript code, then you can use encodeURIComponent, like this:

var url = `someurl?tolink=${encodeURIComponent(thelink)}`;

If you hard-coded it, then replace the & with %26.

EDIT

Based on the discussion in the comment-section it looks like there was not much that could be done with the parameter definition, as it was defined somewhere else and, as a result a broken link was received. Hence, $_SERVER['QUERY_STRING'] helped in solving the issue, as that contained the full query string.

1. Use urlencode() when passing the URL as a parameter:

$amazonURL= 'your_amazon_url_here';

$encodedURL = urlencode($amazonURL);

// then you can use $encodedURL as a parameter

2. Use urldecode() when using the URL:

$url = urldecode($_GET['tolink']);

header("HTTP/1.1 301 Moved Permanently"); 

header("Location: $url");