Comment by Sardtok

& as an escape character only applies to text nodes. Of course, if you want to display the URL on a page, you have to escape it, but not in the href.