0
@@ -160,7 +160,7 @@ module HTML
0
         if !options[:attributes].include?(attr_name) || contains_bad_protocols?(attr_name, value)
0
           node.attributes.delete(attr_name)
0
         else
0
-          node.attributes[attr_name] = attr_name == 'style' ? sanitize_css(value) : CGI::escapeHTML(value)
0
+          node.attributes[attr_name] = attr_name == 'style' ? sanitize_css(value) : CGI::escapeHTML(CGI::unescapeHTML(value))
0
         end
0
       end
0
     end

0
@@ -247,7 +247,10 @@ class SanitizerTest < Test::Unit::TestCase
0
   def test_should_not_remove_unknown_tags
0
      assert_sanitized %{begin <foo>foobar</bar> end}, 'begin &lt;foo>foobar&lt;/bar> end'
0
   end
0
- 
0
+  
0
+  def test_should_not_mangle_urls_with_ampersand
0
+     assert_sanitized %{<a href=\"http://www.domain.com?var1=1&amp;var2=2\">my link</a>}
0
+  end
0
 
0
 protected
0
   def assert_sanitized(input, expected = nil)