diff --git a/src/api/encoding.rs b/src/api/encoding.rs
index 63c5dee2..b3fbbe34 100644
--- a/src/api/encoding.rs
+++ b/src/api/encoding.rs
@@ -2,7 +2,8 @@
 
 /// Escape &str for xml inclusion
 pub fn xml_escape(s: &str) -> String {
-	s.replace("<", "&lt;")
+	s.replace("&", "&amp;")
+		.replace("<", "&lt;")
 		.replace(">", "&gt;")
 		.replace("\"", "&quot;")
 }