wp_import_upload_form() needs to escape ampersands

[JeremyVisser]

If you navigate to the Movable Type importer at /wp-admin/admin.php?import=mt, you'll find that there is an ampersand (&) all by its lonesome in the action attribute of a form element. This completely breaks the page for people using application/xhtml+xml as their html_type option value.

Patch coming soon, unless someone else gets there first.

This appears to be originating in the add_query_arg() function. I don't know how to fix it, as remove_query_arg() would need to be modified as well.

Perhaps a milestone of 2.2 would be better?

Fixes the XHTML invalidity.

OK, the problem was in /wp-admin/admin-functions.php, where wp_import_upload_form didn't encode the $action being passed to it.

I think we should use attribute_escape here, yes?

Fixed for #3937.