If you don't want to use CGI.pm, don't forget /g regex modifier, and remember to substitute the ampersands first, then angle brackets.