replace & with &amp;