this is xml, so & has to be escaped