Really do replacement of & last to avoid bad interactions between &

replacement and replacements based on the entities parameter.

Lib/xml/sax/saxutils.py

@@ -43,10 +43,10 @@ def unescape(data, entities={}):
     """
     data = data.replace("&lt;", "<")
     data = data.replace("&gt;", ">")
-    # must do ampersand last
-    data = data.replace("&amp;", "&")
     if entities:
         data = __dict_replace(data, entities)
+    # must do ampersand last
+    data = data.replace("&amp;", "&")
     return data
 
 def quoteattr(data, entities={}):