Earlier quoted context omitted.
Seems Like the recommendation changed from supporting ; and & to only using &. Thinking about it, it is a little surprising as, if I remember correctly, in HTML source you should encode & as & right?
& as an escape character only applies to text nodes. Of course, if you want to display the URL on a page, you have to escape it, but not in the href.
The spec states it as: “Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand.”
Whereas in the the days before HTML5 this has been mandatory.
> HTML 4.01 Specification – Appendix B.2.2 “Ampersands in URI attribute values”
https://www.w3.org/TR/html401/appendix/notes.html#h-B.2.2
> Unfortunately, the use of the “&” character to separate form fields interacts with its use in SGML attribute values to delimit character entity references.