Escape & as &amp;