when checking for sanitized html ignore "&" characters