fix bug with escape entity '&'