php-fpm worker hangs indefinitely when sharing Photos album with group containing ampersand (&)

[finnlem000]

Describe the bug
Sharing a Photos album with a group whose name contains & hangs permanently server-side. A php-fpm worker handling the request keeps running indefinitely afterward, pinned at 100% of one CPU core. Repeating the share leaves another stuck worker each time, so CPU load accumulates.

Behavior in the UI is inconsistent: a red error message is only sometimes shown. Often the share appears to succeed with no visible error, but on reload the album is not actually shared with the group — while the stuck php-fpm worker is still left running regardless. This occurs whether the album contains photos or is empty.

Sharing with a group that has no special characters works instantly and correctly. Reproduced via the web frontend in the official Photos app, and the Memories app.

To Reproduce
Steps to reproduce the behavior:

1. Create a group with & in its name, e.g. test & gruppe.
2. Try to share an album (with photos or empty) with that group.
3. Sometimes an error message appears; sometimes the UI shows no error at all, but after a reload the album is not actually shared with the group. In both cases, a php-fpm worker is left running at 100% of one CPU core indefinitely afterward.
4. Control: same steps with a group with no special characters (e.g. testgruppe2) → succeeds instantly, no hang.

Expected behavior
Sharing an album with a group should work regardless of special characters in the group name. At minimum, a failed share should not leave a worker hanging indefinitely, and the UI should consistently report failure when the share did not succeed.

Desktop (please complete the following information):

• OS: Fedora Linux
• Browser: Firefox
• Version: 156.0

Smartphone (please complete the following information):

• Device: Pixel 9a
• OS: Android 17
• Browser: Firefox
• Version: 157.0