For XSL (on really lazy days) I use:
capture="&(?!amp;)" capturereplace="&"
to translate all &-signs that aren't follwed på amp; to proper ones.
We have cases where the input is in CDATA but the system which uses the XML doesn't take it into account. It's a sloppy fix, beware...