According to a reference here, the ampersand must be converted into an entity in element content. Change that to &; and it'll be more valid. (Think of it this way -- if bare ampersands were allowed, how would you be able to find entities?)

I suspect that may have a dramatic effect on how CGI.pm works.