PayPal Error When Phone Number Contains Ampersan Symbol

I stumbled across this bug when one of my client's customer's accidentally put the symbol "&" instead of the number "7". This caused the XML sent to PayPal to break and resulted in PayPal responding that the order total didn't match the cart totals. Error code 10413.

So, either the PayPal module needs to be updated to convert to html entities (not sure if that will solve the issue or not), or we need some sort of sanitization of the telephone number on create account.

Have you been able to repeat this?

I have in my Zen Cart customer record the phone with an & and I check out fine with PayPal Express in v1.3.9h ...