CDATA in attributes is forbidden.
Ampersands in attributes are forbidden.
Ampersands anywhere except CDATA are forbidden.
So if I have data that potentially contains an ampersand, I have two options:

this

<books>
<book title="Withnail &amp; I"/>
<book title="Griffin &amp; Sabine"/>
<book title="Love &amp; Marriage"/>
</books>

or this

<books>
<book><title><![CDATA[Withnail & I]]></title></book>
<book><title><![CDATA[Griffin & Sabine]]></title></book>
<book><title><![CDATA[Love & Marriage]]></title></book>
</books>

which would you choose?
and why?