HTTP Parameter Pollution

?app=mail%26action=delete
<?php 
echo <<<EOB
<a href="http://example.yahoo.com?app={$_GET['app']}">Link</a>
EOB;
?>