[basex-talk] XPATH injection / escaping

Hello, How to write secure queries when the queried text nodes contain ampersands? For instance: declare variable $publisher external; (: $pub == 'Faber & Faber' :) declare variable $db := db:open('db'); let $records := $db/record/publisher[. = $publisher] (: publisher == 'Faber & Faber' :) The external variable is unsafe input, escaped by the sending application. Escaping the ampersand in the external variable with & (& a m p ;) doesn't work, Basex stops finding hits. Just letting the ampersand pass might expose the code to injection attacks? I could switch to a full-text query and remove the ampersand from the external variable, but that's a bit hackish. The expression is exact. How to proceed in a secure way?