Index: httpd-2.2.8/modules/mappers/mod_rewrite.c
===================================================================
--- httpd-2.2.8.orig/modules/mappers/mod_rewrite.c
+++ httpd-2.2.8/modules/mappers/mod_rewrite.c
@@ -1073,6 +1073,30 @@ static char *rewrite_mapfunc_escape(requ
     return ap_escape_uri(r->pool, key);
 }
 
+static char *rewrite_mapfunc_ampescape(request_rec *r, char *key)
+{
+    /* we only need to escape the ampersand */
+    unsigned char *copy = (char *)apr_palloc(r->pool, 3 * strlen(key) + 3);
+    const unsigned char *s = (const unsigned char *)key;
+    unsigned char *d = (unsigned char *)copy;
+    unsigned c;
+
+    while ((c = *s)) {
+        if (c == '&') {
+            *d++ = '%';
+            *d++ = '2';
+            *d++ = '6';
+        }
+        else {
+            *d++ = c;
+        }
+        ++s;
+    }
+    *d = '\0';
+
+    return copy;
+}
+
 static char *rewrite_mapfunc_unescape(request_rec *r, char *key)
 {
     ap_unescape_url(key);
@@ -4040,6 +4064,7 @@ static int pre_config(apr_pool_t *pconf,
         map_pfn_register("tolower", rewrite_mapfunc_tolower);
         map_pfn_register("toupper", rewrite_mapfunc_toupper);
         map_pfn_register("escape", rewrite_mapfunc_escape);
+        map_pfn_register("ampescape", rewrite_mapfunc_ampescape);
         map_pfn_register("unescape", rewrite_mapfunc_unescape);
     }
     return OK;