TYPO3 Core

is replaced with this:
<a href="index.php?id=16&no_cache=1&tx_newloginbox_pi1[forgot]=1">

the url contains ampersands (&) instead of the htmlentity &
this does not conform to xhtml 4.0

i had a problem with other extensions, however putting
config.xhtml_cleaning = all
into typoscript setup solved the problem for most of them

i reviewed the source to newloginbox but couldn't find where i would change this behaviour.
usually when the typolink function is used, this error will not occur. config.xhtml_cleaning usually takes care of most other cases.
(issue imported from #M4944)