If it does not work, this is not because the ampersands are shielded. As an attribute in an HTML element, all XML elements must be escaped:
--+-------
< | <
> | >
" | "
& | &
, index.php?foo=bar&buzz=baz, , a , :
<a href="index.php?foo=bar&buzz=baz
href : index.php?foo=bar&buzz=baz
, .