Should I validate the redirect URL?

Worldpay does not encode the redirect URL we send you in our response, so you should always validate it to check for escaped characters. 

For example, a correctly validated URL should not contain amp;. Use & instead. See an example redirect URL at Worldpay developers.