If you insist on filtering the source yourself, rather than using routines in CGI.pm, you'll need to add:     $source=~s/&/&/g;