If your CGI gets ampersand escapes submitted by a browser, you're doing something wrong. The browser uses those only as a fallback when it cannot encode characters in a field in the encoding requested, and if you get that fallback you will not be able to decode the original text completely because ampersands themselves are not encoded.
The solution to this is to ask the browser to submit the form with the values encoded in utf-8 encoding. There are two ways to do this, either of which you have to apply when you serve the form that the browser will them submit. The better way is to send the html page with the form itself utf-8 encoded and tell this to the browser, with either the Content-Type header or the corresponding meta http-equiv element. The worse way is to set the accept-charset attribute on each form element. Note that the CGI might not actually get feedback from the browser on what encoding the browser has actually used, so the best you can do is to always request utf-8 encoding for a form.