escape ampersands in text data; otherwise query fails