From Facebook Developer Wiki

To be safe, you may want to url-encode the 'properties' string. This might be needed in case your object data might include ampersands '&', which will corrupt the request. Make sure you do this after you have calculated the sig since the backend will be calculating the sig with url-decoded strings.