Escape & even if it looks like an HTML entity. 

Don't try to prevent double-escaping.