replace ampesand with escaped character