& as & in URLs not for HTML?

Hi,
We currently use Xalan to transform our XML files to HTML 4. At least the used
version (2.4 or 2.5 I think) does not escape & to & for attributes (URLs
of img/@src for example). When changing the xsl:output to "xml" and actually
producing XHTML it does.

Is this a Xalan only behaviour or actually correct? The W3C validator does not
validate HTML4 pages with unescaped ampersands so I suspect a Xalan problem
but maybe it actually is correct...

Thanks for any hint

Chris