<input tupe="text" name="foo" value="bing&bong=bang">

The browser is required to encode the value. If you find one that doesn't, I'd be interested in knowing. Although, I should also note that technically the above is not good HTML; the ampersand should really be given as an entity, which the browser will decode; however, when the browser submits a form, it is always required to encode certain characters (including equal signs and ampersands) in an any of the keys or values using the CGI-style encoding (with the percent sign). And in practice, the unencoded ampersand in the quoted attribute like that will only be a problem if the document is served as XML (in which case, the document won't render at all; the browser will show an error message to the effect that it's invalid); with an HTML content type, all major browsers will handle the above in the intended way.

$;=sub{$/};@;=map{my($a,$b)=($_,$;);$;=sub{$a.$b->()}}
split//,".rekcah lreP rehtona tsuJ";$\=$ ;->();print$/
[download]