Hello,
no, thats not a bug. Its correct encoded for XML.
The '&' is a reserved char in XML and has to be encoded to &
The link on your page is for example ...../mylinks/singlelink.php?cid=1&lid=12
The '&' has to be encoded and the result for XML is ...../mylinks/singlelink.php?cid=1&lid=12
When the sitemap crawler reads the XML file, then it decodes the '&' back to '&' and the URL is the same as on your page.
Btw, I think that the ...../mylinks/singlelink.php?cid=1&lid=12 URLs are generated by a module of your site. The browser will translate it to ...../mylinks/singlelink.php?cid=1&lid=12, so its not a problem.
View with your browser the source code of the index page of your site and search for singlelink.php?cid=1&lid=12 and you will find it.
Regards
Elmar