URLs and other attributes not being escaped

[davidearl]

[link](http://example.com?one=one&two=two)
(and similar) should translate as
<a href="http://example.com?one=one&amp;two=two>...</a>
but it doesn't, it isn't escaping the ampersand.

Similarly an ampersand in title or alt for an image is not being escaped, and nor are double quotes (if you could get those in there in the first place, as there is a separate bug preventing this which I shall add in a moment).