So even if your URL is not dynamic, you need to htmlspecialchars() the URL.
You'll notice that the in the URL is replaced by amp;. Although most browsers will recover if you forget this, this isn't always possible. So even if your URL is not dynamic, you need to htmlspecialchars() the URL.