CCBill links with encoded '&' don't work

[cd34]

In Firefox 1.5.0.6 with cookies set to 'Ask Everytime'

if I key the link in directly into firefox, & will not set the cookie
If I key the link in directly with & rather than &, it will set the cookie
If I cut and paste a link from a page set with a doctype of transitional, it works.
If I cut and paste a link on a doctype set with strict and the url not contained within CDATA (in other words, a page that won't validate) , the cookie is not set.

Additionally, if the link is coded through a script and sent as:

<a href="test.php?blahblah=1&j=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=xxxxxx-0000&amp;PA=xxxxxx">test</a>

<?php

header("Location: {$_REQUEST['j']}");

?>

it will not set the cookie because the location header that 99% of the tradescripts are using doesn't de-entify before sending to ccbill.

IE exhibits some odd behavior depending on which version you use. 5.5 does not deentify before sending in my tests. 6.0 does most of the time, but, failed once. I believe ccbill should set the cookie each time regardless of whether there is already a cookie present for that master account number, but, that isn't what I observed in one of the tests I did above. And after it happened, I couldn't duplicate it.

According to the RFC, the browser is supposed to deentify when going to a url, but, clearly when you cut and paste a url into firefox, there is no way for firefox to guess what action it should take.

Personally, I wouldn't want to rely on the browser guessing at what is supposed to happen.