> While & is illegal in XML and HTML it is perfectly legal (and 
> required) in an URL. 

But when the URL is embedded in an XML or HTML document, the & must be
escaped as &

> Unfortunately the server 
> thinks these two URLs are different:
> http://myserver/action.do?action=Approve&ID=7
> http://myserver/action.do?action=Approve&ID=7
> 

The server should never see the second form. If you write & in your HTML
document, that is a representation of &, and the server will see the first
form.

Perhaps you tested by typing these two URLs into the address box of your
browser. That's different: in the address box, there's no HTML parser
involved.

Michael Kay
http://www.saxonica.com/