答案是不行，需要 escape 成 &。 根據 XML 的規範：
The ampersand character (&) and the left angle bracket (<)
must notappear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section. If they are needed elsewhere, they must be escaped using either numeric character references or the strings "&" and "<" respectively
起因是在 paring 某家 IPCAM 的 ONVIF stream URI 時。它的 tag 是
<tt:Uri>rtsp://192.168.1.100:554/cam/realmonitor?channel=1&subtype=0&unicast=true&proto=Onvif</tt:Uri>
程式把 URI 拿出來就直接用了，沒有把 & decode 成 &， 拿著這串夾帶 & 的 URI 去向 IPCAM 做請求，回覆 404 Not Found，連線失敗，修正成 & 後就 OK 了。