use decoded "url" parameter instead of raw $QUERY_STRING.