& needs to be escaped or otherwise an entity might be injected