In onebox, `&` become `&`

Support
2

So the URL will be valid?

This is usually a cascading error caused by a an undefined entity reference or use of an unencoded ampersand (&) in an URL or body text.