`&` should be escaped to `&amp;`