BUG: fix to_html double escaping

Author: gdraps

pandas/core/format.py

@@ -11,6 +11,7 @@
 from pandas.core.common import adjoin, isnull, notnull
 from pandas.core.index import Index, MultiIndex, _ensure_index
 from pandas.util import py3compat
+from pandas.util.compat import OrderedDict
 from pandas.core.config import get_option, set_option, reset_option
 import pandas.core.common as com
 import pandas.lib as lib
@@ -520,7 +521,10 @@ def _write_cell(self, s, kind='td', indent=0, tags=None):
             start_tag = '<%s>' % kind
 
         if self.escape:
-            esc = {'<' : r'&lt;', '>' : r'&gt;', '&' : r'&amp;'}
+            # escape & first to prevent double escaping of &
+            esc = OrderedDict(
+                [('&', r'&amp;'), ('<', r'&lt;'), ('>', r'&gt;')]
+            )
         else:
             esc = {}
         rs = com.pprint_thing(s, escape_chars=esc)