replaces & with &amp;