replace & with &amp; to fix validation errors