diff --git a/ui-commit.c b/ui-commit.c
index 6b135aa..1d12bbb 100644
--- a/ui-commit.c
+++ b/ui-commit.c
@@ -75,7 +75,7 @@ void print_fileinfo(struct fileinfo *info)
 		html("]</span>");
 	}
 	htmlf("</td><td class='%s'>", class);
-	query = fmt("id=%s&id2=%s&path=%s", sha1_to_hex(info->old_sha1),
+	query = fmt("id=%s&amp;id2=%s&amp;path=%s", sha1_to_hex(info->old_sha1),
 		    sha1_to_hex(info->new_sha1), info->new_path);
 	html_link_open(cgit_pageurl(cgit_query_repo, "diff", query),
 		       NULL, NULL);
@@ -182,7 +182,7 @@ void cgit_print_commit(const char *hex)
 	cgit_print_date(info->committer_date, FMT_LONGDATE);
 	html("</td></tr>\n");
 	html("<tr><th>tree</th><td colspan='2' class='sha1'><a href='");
-	query = fmt("h=%s&id=%s", sha1_to_hex(commit->object.sha1),
+	query = fmt("h=%s&amp;id=%s", sha1_to_hex(commit->object.sha1),
 		    sha1_to_hex(commit->tree->object.sha1));
 	html_attr(cgit_pageurl(cgit_query_repo, "tree", query));
 	htmlf("'>%s</a></td></tr>\n", sha1_to_hex(commit->tree->object.sha1));
@@ -201,7 +201,7 @@ void cgit_print_commit(const char *hex)
 		html_attr(cgit_pageurl(cgit_query_repo, "commit", query));
 		htmlf("'>%s</a> (<a href='",
 		      sha1_to_hex(p->item->object.sha1));
-		query = fmt("id=%s&id2=%s", sha1_to_hex(parent->tree->object.sha1),
+		query = fmt("id=%s&amp;id2=%s", sha1_to_hex(parent->tree->object.sha1),
 			    sha1_to_hex(commit->tree->object.sha1));
 		html_attr(cgit_pageurl(cgit_query_repo, "diff", query));
 		html("'>diff</a>)</td></tr>");
@@ -210,7 +210,7 @@ void cgit_print_commit(const char *hex)
 		htmlf("<tr><th>download</th><td colspan='2' class='sha1'><a href='");
 		filename = fmt("%s-%s.zip", cgit_query_repo, hex);
 		html_attr(cgit_pageurl(cgit_query_repo, "snapshot",
-				       fmt("id=%s&name=%s", hex, filename)));
+				       fmt("id=%s&amp;name=%s", hex, filename)));
 		htmlf("'>%s</a></td></tr>", filename);
 	}
 	html("</table>\n");
diff --git a/ui-log.c b/ui-log.c
index c80fd73..75bbbe4 100644
--- a/ui-log.c
+++ b/ui-log.c
@@ -114,14 +114,14 @@ void cgit_print_log(const char *tip, int ofs, int cnt, char *grep, char *path)
 	if (ofs > 0) {
 		html("&nbsp;<a href='");
 		html(cgit_pageurl(cgit_query_repo, cgit_query_page,
-				  fmt("h=%s&ofs=%d", tip, ofs-cnt)));
+				  fmt("h=%s&amp;ofs=%d", tip, ofs-cnt)));
 		html("'>[prev]</a>&nbsp;");
        	}
 
 	if ((commit = get_revision(&rev)) != NULL) {
 		html("&nbsp;<a href='");
 		html(cgit_pageurl(cgit_query_repo, "log",
-				  fmt("h=%s&ofs=%d", tip, ofs+cnt)));
+				  fmt("h=%s&amp;ofs=%d", tip, ofs+cnt)));
 		html("'>[next]</a>&nbsp;");
 	}
 	html("</div>");
diff --git a/ui-shared.c b/ui-shared.c
index c8c1c21..aba93e8 100644
--- a/ui-shared.c
+++ b/ui-shared.c
@@ -69,9 +69,9 @@ char *cgit_pageurl(const char *reponame, const char *pagename,
 				   pagename);
 	} else {
 		if (query)
-			return fmt("?r=%s&p=%s&%s", reponame, pagename, query);
+			return fmt("?r=%s&amp;p=%s&amp;%s", reponame, pagename, query);
 		else
-			return fmt("?r=%s&p=%s", reponame, pagename);
+			return fmt("?r=%s&amp;p=%s", reponame, pagename);
 	}
 }
 
diff --git a/ui-summary.c b/ui-summary.c
index 18608b8..15e8aec 100644
--- a/ui-summary.c
+++ b/ui-summary.c
@@ -159,7 +159,7 @@ static int cgit_print_archive_cb(const char *refname, const unsigned char *sha1,
 	}
 	html("<tr><td>");
 	url = cgit_pageurl(cgit_query_repo, "blob",
-			   fmt("id=%s&path=%s", sha1_to_hex(fileid),
+			   fmt("id=%s&amp;path=%s", sha1_to_hex(fileid),
 			       buf));
 	html_link_open(url, NULL, NULL);
 	html_txt(buf);
diff --git a/ui-tree.c b/ui-tree.c
index 006ca47..cb57d8d 100644
--- a/ui-tree.c
+++ b/ui-tree.c
@@ -37,7 +37,7 @@ static int print_entry(const unsigned char *sha1, const char *base,
 	} else if (S_ISDIR(mode)) {
 		html("class='ls-dir'><a href='");
 		html_attr(cgit_pageurl(cgit_query_repo, "tree",
-				       fmt("h=%s&id=%s&path=%s%s/",
+				       fmt("h=%s&amp;id=%s&amp;path=%s%s/",
 					   curr_rev,
 					   sha1_to_hex(sha1),
 					   cgit_query_path ? cgit_query_path : "",
@@ -45,7 +45,7 @@ static int print_entry(const unsigned char *sha1, const char *base,
 	} else {
 		html("class='ls-blob'><a href='");
 		html_attr(cgit_pageurl(cgit_query_repo, "view",
-				      fmt("h=%s&id=%s&path=%s%s", curr_rev,
+				      fmt("h=%s&amp;id=%s&amp;path=%s%s", curr_rev,
 					  sha1_to_hex(sha1),
 					  cgit_query_path ? cgit_query_path : "",
 					  pathname)));
@@ -55,7 +55,7 @@ static int print_entry(const unsigned char *sha1, const char *base,
 
 	html("<td class='links'><a href='");
 	html_attr(cgit_pageurl(cgit_query_repo, "log",
-			       fmt("h=%s&path=%s%s",
+			       fmt("h=%s&amp;path=%s%s",
 				   curr_rev,
 				   cgit_query_path ? cgit_query_path : "",
 				   pathname)));
diff --git a/ui-view.c b/ui-view.c
index dbe4b29..8873415 100644
--- a/ui-view.c
+++ b/ui-view.c
@@ -43,7 +43,7 @@ void cgit_print_view(const char *hex, char *path)
 
 	html(" <a href='");
 	html_attr(cgit_pageurl(cgit_query_repo, "blob", 
-			       fmt("id=%s&path=%s", 
+			       fmt("id=%s&amp;path=%s", 
 				   hex,
 				   path)));
 	html("'>download</a>");