When a Web Link or BasicLTI launch URL includes an Ampersand (&) Moodle dies during import with a message like:

Fatal Error in [tempdir] ../moodle.xml: EntityRef: expecting ';' at line 250

Tracing things through, the cartridge is XML so the entity version is correct - as Moodle unzips and extracts the cartridge it is mapped back  to "&" but then as Moodle produces the moodle.xml file (also XML) it fails to re-encode from "&" as an entity so something like "&x=42" looks like a malformed "entity" to the XML parser, leading to the error.

I have attached a two-item cartridge with no ampersands in the urls, and one with ampersands in the URLs.  I have screen shots of the successful import on demo.moodle.net as well as the failed import on demo.moodle.net as well as a look at the moodle.xml file (from a different, larger import) showing what went wrong in moodle.xml.