Needless escape of ampersand in SO flair

Question

There seems to be a minor but annoying issue with flair generation on SO. I noticed that the tooltip displayed when I put the cursor over my flair says:

profile for Tom at Stack Overflow, Q&A for professional and enthusiast programmers

The entity is displayed literally, not as the & character. The generated code is just wrong:

<a href="http://stackoverflow.com/users/1407656/tom">
<img src="http://stackoverflow.com/users/flair/1407656.png" width="208" 
     height="58" alt="profile for Tom at Stack Overflow, Q&amp;amp;A for professional and enthusiast programmers" 
     title="profile for Tom at Stack Overflow, Q&amp;amp;A for professional and enthusiast programmers">
</a>

I can easily fix this myself when posting the flair by changing the title attribute and replacing the entity with an ampersand. Then browsers render it correctly as:

profile for Tom at Stack Overflow, Q&A for professional and enthusiast programmers

but I think it should be generated correctly from the start.

Answer 1

A fix for this is rolling out as I type.

We're touching lots and lots of old code, getting rid of lots of StringBuilder junk (from the days before Razor, generally). Unfortunately I'm expecting lots of little oversights like this, encoding rules are all very implicit in the old stuff.

Thanks for pointing this out.