diff --git a/extlib/Net/URL/Mapper/Path.php b/extlib/Net/URL/Mapper/Path.php
index eb1c34a3fa..b541002c7a 100644
--- a/extlib/Net/URL/Mapper/Path.php
+++ b/extlib/Net/URL/Mapper/Path.php
@@ -241,12 +241,7 @@ class Net_URL_Mapper_Path
         }
         $path = '/'.trim(Net_URL::resolvePath($path), '/');
         if (!empty($qstring)) {
-            if (!strpos($path, '?')) {
-                $path .= '?';
-            } else {
-                $path .= '&';
-            }
-	    $path .= http_build_query($qstring);
+            $path .= '?'.http_build_query($qstring);
         }
         if (!empty($anchor)) {
             $path .= '#'.ltrim($anchor, '#');
@@ -432,4 +427,4 @@ class Net_URL_Mapper_Path
 
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/lib/router.php b/lib/router.php
index e39dc217a3..135e07a0f0 100644
--- a/lib/router.php
+++ b/lib/router.php
@@ -429,6 +429,16 @@ class Router
             $args = $action_arg;
         }
 
-        return $this->m->generate($args, $params, $fragment);
+        $url = $this->m->generate($args, $params, $fragment);
+
+        // Due to a bug in the Net_URL_Mapper code, the returned URL may
+        // contain a malformed query of the form ?p1=v1?p2=v2?p3=v3. We
+        // repair that here rather than modifying the upstream code...
+        $qpos = strpos($url,'?');
+        if ($qpos !== false) {
+            $url = substr($url, 0, $qpos+1) .
+	              str_replace('?', '&', substr($url, $qpos+1));
+        }
+        return $url;
     }
 }