escape character & as &amp;