& must be encoded as &