Ampersands in shortcode attribute values

I’m running into a bit of a puzzle with a custom shortcode I’m developing. It can take as input strings containing &-characters sortof like so:
[mycode input="a&b"]
The value ‘a&b’ is then matched against entries in a MySQL-DB, and some integer values returned. (You can think of the entire system as an elaborate associative array.) The problem is that for some reason the ‘a&b’-string is not found in the DB, even if a manual query yields the requested information just fine.

After some experimenting I discovered that if I HTML-ised the ampersand like so:
[mycode input="a&b"]
and then used PHP’s htmlspecialchar_decode() on the value before passing it onto the DB, the query would succeed. This led me to believe that somehow the lonely ampersand is escaped/replaced/altered before the shortcode gets to see it, or perhaps even during shortcode processing.

My questions: a) is this hypothesis correct? b) if so, what happens exactly when? c) is there a way to disable this process? and d) if not, are there other options to allow ampersands in values of shortcode attributes without coding them like a HTML entity?

(Apologies: in the second example I wanted to write out the HTML-ised code for the ampersand so ‘glyph for ampersand’amp;, but I’m defeated by the post processing system.)