& should not be XML-encoded. You are making an assumption that the generated query string will be used inside HTML/XML but that is not always true. You should perform only URL-encoding of key/value. The code that uses the query string can call ``$escapetool.xml($queryString)`` if it needs to.