The "&" character in the value (user login name) is not properly escaped by the User Picker custom field in the XML view. (Probably in other user custom field types too.)

Reproduction sequence:
1. Create a user with login name "a&b"
2. Create a User Picker custom field
3. On any issue, set the value of the field to that user.
4. Open XML view of the issue

Observed:
<customfieldvalue>a&b</customfieldvalue>

Expected:
<customfieldvalue>a&amp;b</customfieldvalue>
or
<customfieldvalue><![CDATA[a&b]]></customfieldvalue>

Note that when the Assignee is set to that user, the login name is properly escaped.