diff --git a/README.md b/README.md
index eddac26..501274d 100644
--- a/README.md
+++ b/README.md
@@ -276,6 +276,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **05.01.23:** - Fix db password setting (sed escape `&`).
 * **21.12.22:** - Update db info in .env file when env vars are updated.
 * **10.10.22:** - Remove password escape logic which caused problems for a small subset of users.
 * **20.08.22:** - Rebasing to alpine 3.15 with php8. Restructure nginx configs ([see changes announcement](https://info.linuxserver.io/issues/2022-08-20-nginx-base)).
diff --git a/readme-vars.yml b/readme-vars.yml
index bce6510..39fb35c 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -104,6 +104,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "05.01.23:", desc: "Fix db password setting (sed escape `&`)." }
   - { date: "21.12.22:", desc: "Update db info in .env file when env vars are updated." }
   - { date: "10.10.22:", desc: "Remove password escape logic which caused problems for a small subset of users." }
   - { date: "20.08.22:", desc: "Rebasing to alpine 3.15 with php8. Restructure nginx configs ([see changes announcement](https://info.linuxserver.io/issues/2022-08-20-nginx-base))." }
diff --git a/root/etc/cont-init.d/50-config b/root/etc/cont-init.d/50-config
index e2840d0..634e127 100644
--- a/root/etc/cont-init.d/50-config
+++ b/root/etc/cont-init.d/50-config
@@ -92,7 +92,7 @@ if [[ -n "${DB_HOST}" ]]; then
     sed -i -E "s/^[#]?DB_PORT=.*/DB_PORT=${DB_PORT}/g" /config/www/.env
     sed -i -E "s/^[#]?DB_DATABASE=.*/DB_DATABASE=${DB_DATABASE}/g" /config/www/.env
     sed -i -E "s/^[#]?DB_USERNAME=.*/DB_USERNAME=${DB_USER}/g" /config/www/.env
-    sed -i -E "s/^[#]?DB_PASSWORD=.*/DB_PASSWORD=${DB_PASS}/g" /config/www/.env
+    sed -i -E "s/^[#]?DB_PASSWORD=.*/DB_PASSWORD=${DB_PASS//&/\\&}/g" /config/www/.env
 fi
 
 # set appurl