escape remaining &'s