title: URL/HTML Escaping/Encoding, Is escaping `&` from URL's actually required?
body: <p>I have always been very confused with URL/HTML Escaping. More recently I looked deeper into it. Then looking at the PHP Docs for <a href="http://sg2.php.net/manual/en/function.urlencode.php" rel="nofollow">urlencode</a></p>
  
  <pre><code>$query_string = 'foo=' . urlencode($foo) . '&amp;bar=' . urlencode($bar);
  echo '&lt;a href="mycgi?' . htmlentities($query_string) . '"&gt;';
  </code></pre>
  
  <p>I then realized that theres <code>&amp;</code> in most query strings that seems like should be escaped. But it seems to work without escaping. I wonder why, and if its actually required. </p>