Ampersand URL parameters in document function - xslt

Question

If I want to load a document into a variable, I can use
<xsl:variable name="var1" select="document('http://www.mySite.com/file1.xml')" />
=> works, I can use -
<xsl:value-of select="$var1//myNodeName"/>
but now I need to use a URL with parameter.
and the following tests do not work -
<xsl:variable name="var2" select="document('http://www.mySite.com/getfile.cgi?param1=val1&param2=val2')" />
=> does not work - EntityRef: expecting ';'
<xsl:variable name="var2" select="document('http://www.mySite.com/getfile.cgi?param1=val1&param2=val2')" />
=> does not work - warn for wrong URL -
http://www.mySite.com/getfile.cgi?param1=val1&param2=val2:1:
why does it add :1: ???
My Question:
How do I replace the & entity to make the document() function work?
Update:
according to -
http://our.umbraco.org/forum/developers/xslt/5421-Ampersand-in-XSLT
the solution is to store the URL as a variable, then output it disablig output escaping.
e.g.
<xsl:variable name="test" select="http://www.mysite.com/mypage.aspx?param1=1&param2=2" />
<xsl:value-of select="$test" disable-output-escaping="yes" />
but, how can I apply this solution with document() parameter?
Update 2:
I parse it using PHP -
<?php
Header('Content-type: text/xml');
// http://php.net/manual/en/xsltprocessor.transformtoxml.php
$xml = new DOMDocument;
$xml->load('http://www.mySite.com/devices.xml');
$xsl = new DOMDocument;
$xsl->load('mergedocs.xsl');
// Configure the transformer
$proc = new XSLTProcessor;
$proc->importStyleSheet($xsl); // attach the xsl rules
echo $proc->transformToXML($xml);
?>
The error I get [note the amp within the URL]:
XML Parsing Error: junk after document element
Location: http://mySite/myPhpFile.php
Line Number 2, Column 1:<b>Warning</b>: XSLTProcessor::transformToXml() [<a href='xsltprocessor.transformtoxml'>xsltprocessor.transformtoxml</a>]:
http://siteIp/cgi-bin/getfile.cgi?p1=v1&p2=v2:1: parser error : Document is empty
in <b>/home/.../myPhpFile.php</b> on line <b>16</b><br />

Answer 1

Encoding the & as & is the correct approach, the URL retrieved by the processor will be the correct one with val1&param2. I suspect the :1: isn't part of the URL but rather part of the warning message i.e. problem at ::