fixed & escaping.

std/haxe/remoting/Connection.hx

@@ -40,6 +40,12 @@ class Connection implements Dynamic<Connection> {
 		return s;
 	}
 
+	#if flash
+	static function escapeString( s : String ) {
+		return s.split("\\").join("\\\\").split("&").join("&amp;");
+	}
+	#end
+
 	public function call( params : Array<Dynamic> ) : Dynamic {
 	#if flash
 		var p = __path.copy();
@@ -47,7 +53,7 @@ class Connection implements Dynamic<Connection> {
 		var path = p.join(".");
 		var s = new haxe.Serializer();
 		s.serialize(params);
-		var params = s.toString().split("\\").join("\\\\");
+		var params = escapeString(s.toString());
 		var s = flash.external.ExternalInterface.call("haxe.remoting.Connection.doCall",path,f,params);
 		if( s == null )
 			throw "Failed to call JS method "+__path.join(".");
@@ -92,7 +98,7 @@ class Connection implements Dynamic<Connection> {
 			var s = new haxe.Serializer();
 			s.serialize(v);
 			#if flash
-			return s.toString().split("\\").join("\\\\");
+			return escapeString(s.toString());
 			#else js
 			return s.toString();
 			#else true