replace any embedded &quot; to avoid browser interp