Escape & even if it looks like an HTML entity. Don't try to prevent double-escaping.