Running 1.38a+security+FEC.

I've got an HTML banner that includes some ampersands (&) and I'm trying to get my pages to validate (which they don't because there are &'s in the HTML instead of &'s). So, I went back into Banner Manager, changed all the &'s to &'s, updated the banner, and viewed it again ... and all the &'s were (once again) &'s.

What's going on here? Any help or pointers would be much appreciated.