Makes sure & is sanitized first.}
This was an oversight. Without this commit '<' and '>' will be wrongly encoded.