You escaped the &
characters correctly.
Note that you can’t enter the URI with escaped ampersands directly into the address bar of your browser. It only works if used in HTML (i.e. in href
and src
attributes).
The URL in question works perfectly as link (and also as image).
Note that you probably don’t have to escape these ampersands (as they seem to be unambiguous); but to be always on the safe side, simply escape them all.