You probably do not really need d-o-e. I hope you are not asking the weekly
FAQ about "&" in an attribute value... (the answer is: "&" is incorrect and
just happens to be tolerated by most browsers, while "&" is correct and
works in all browsers)

Unfortunately, Netscape 4.x passes the unescaped string after the javascript:
directly to the JS interpreter, which leads to &s posted to the server,
which is bad.
This is the only instance I personally encountered where & doesn't work
in a href attribute.