Problem with urls that contain a query (especially ampersands &)

Hi!

It seems that WYSIWYG editors save html special chars in their encoded format.
So, '&' (ampersand) becomes '&' in the database.
Fortunately somewhere these entities gets decoded when a node is displayed.

The problem arises when Urlicon processes an url with a query (containing ampersands).
Everything is just fine until in theme_urlicon(...) the l()-function is called.
Within this function check_url is called and that in turn calls filter_xss_bad_protocol($uri, FALSE);
Unfortunately FALSE means that the urls is not decoded before any further processing.

In the end the html special chars are encoded twice and look like this: &
Such a query does not work anymore.

A solution would be to call
$path = decode_entities($path);
just before
return l($text .' '. $favicon, $path, array('absolute' => TRUE, 'html' => TRUE));
in theme_urlicon.

Or does anybody know how to prevent WYSIWYG editors from saving encoded special chars? I am using WYSIWYG API + FCKEditor.