Escape & in the command to execute

Since we often pass & in URLs to pass multiple parameters, this broke
rather quickly. Now it works though :)