Escape &

#80 wasn't enough to escape `&` : have to use HTML entity `&amp;`