<?php

class GoogleCodePrettify {

  public static $prettified = false;

  public static function parserHook($text, $args = array(), $parser) {
    $pre_classes = '';
    if (isset($args['lang']) && $args['lang']) {
      $lang = $args['lang'];
      $pre_classes .= " lang-$lang";
    }
    if (isset($args['class']) && $args['class']) {
      $pre_classes .= ' '. $args['class'];
    }

    # Replace all < and > with their HTML entitites
    #
    $text = str_replace('<', '&lt;', $text);
    $text = str_replace('>', '&gt;', $text);

    self::$prettified = true;

    return "<pre class=\"prettyprint$pre_classes\">$text</pre>";
  }

  public static function beforePageDisplay(&$wgOut, &$sk) {
    $wgOut->addModules('ext.GoogleCodePrettify');
    // Continue
    return true;
  }
}

<?php

class GoogleCodePrettify {

  public static $prettified = false;

  public static function parserHook($text, $args = array(), $parser) {
    $pre_classes = '';
    if (isset($args['lang']) && $args['lang']) {
      $lang = $args['lang'];
      $pre_classes .= " lang-$lang";
    }
    if (isset($args['class']) && $args['class']) {
      $pre_classes .= ' '. $args['class'];
    }

    # Replace all '&', '<,' and '>' with their HTML entitites. Order is
    # important. You have to do '&' first.
    #
    $text = str_replace('&', '&amp;', $text);
    $text = str_replace('<', '&lt;', $text);
    $text = str_replace('>', '&gt;', $text);

    self::$prettified = true;

    return "<pre class=\"prettyprint$pre_classes\">$text</pre>";
  }

  public static function beforePageDisplay(&$wgOut, &$sk) {
    $wgOut->addModules('ext.GoogleCodePrettify');
    // Continue
    return true;
  }
}

Replace & in source with &amp; in output
Replace & in source with &amp; in output

Avoid accidental HTML entitites by escaping '&' in input with '&amp;' so
that the code output can really be treated as raw code.
