properly handle '&' within a Filter using a wrapper around CGI.escape