Really do replacement of & last to avoid bad interactions between &
replacement and replacements based on the entities parameter.
diff --git a/Lib/xml/sax/saxutils.py b/Lib/xml/sax/saxutils.py
index 049e09c..035715c 100644
--- a/Lib/xml/sax/saxutils.py
+++ b/Lib/xml/sax/saxutils.py
@@ -43,10 +43,10 @@
     """
     data = data.replace("&lt;", "<")
     data = data.replace("&gt;", ">")
-    # must do ampersand last
-    data = data.replace("&amp;", "&")
     if entities:
         data = __dict_replace(data, entities)
+    # must do ampersand last
+    data = data.replace("&amp;", "&")
     return data
 
 def quoteattr(data, entities={}):