ampersand being removed from buy_url on import

I've noticed recently that & is getting removed from the buy_url of .xml feeds. It doesn't happen with csv files.

I've checked the admin.php file, but can't see any reason as to why it's happening.

Any thoughts?