XHTML compliance, unescaped ampersand in flashvars

Used code:

 $animation_settings=array (
  'params' => array ( 
    'width' => '940',
    'height' => '106',
  ),
  'flashvars' => array (
    'banner_files' => $photo_files,
    'banner_slogans' => $photo_titles,
  ),
 );
 $animation=url($directory.'/flash/header.swf');
 print swf($animation,$animation_settings);

This displays correctly but does not validate XHTML 1.0 Strict.

The problem is in:
<param name="flashvars" value="banner_files=%2Fsites%2Fdefault%2Ffiles%2Fimagecache%2Fheader_pictures%2FFishersAtAviles.jpg%2C%2Fsites%2Fdefault%2Ffiles%2Fimagecache%2Fheader_pictures%2Fafter_the_fun.jpg&banner_slogans=Sea%20fishing%2CFun%20activities" />

The different flashvars are separated by & and it should by & according to the w3c validator:

An entity reference was found in the document, but there is no reference by that name defined. Often this is caused by misspelling the reference name, unencoded ampersands, or by leaving off the trailing semicolon (;). The most common cause of this error is unencoded ampersands in URLs as described by the WDG in "Ampersands in URLs".

Entity references start with an ampersand (&) and end with a semicolon (;). If you want to use a literal ampersand in your document you must encode it as "&" (even inside URLs!).

I'll try to come up with a patch for this.