An ampersand in any XML document (including a stylesheet) must be escaped as
to make it valid XML.
The HTML serializer will also output
in the generated HTML. This is required by the HTML specification. It's common for people writing HTML by hand to ignore this rule, and HTML browsers are very forgiving, but the correct form is to escape it, and every browser will accept it in that form.