Look in ESP8266Basic.ino at lines 978 and 986:
server->sendContent(TextboxProgramBeingEdited + CRLF);
I think changing it to this will solve the problem:
server->sendContent(TextboxProgramBeingEdited.replace(F("&"),F("&")) + CRLF);
This is a quick and dirty fix. I suspect that we will see the same problem in the debugger so it might be a good idea to make a function out of this to be called by the editor and the debugger.
String escapeHTMLentities(String HTMLtext) { return HTMLtext.replace(F("&"),F("&")) }
Either way....