It is an error in the markup and, as such, should not be ignored.

PHP adds query string variables to URLs in documents when sessions are enabled.
By default it generates code that is invalid under every version of (X)HTML. The
PHP manual describes how to configure the system to use correctly escaped
ampersands (although it only mentions XHTML).

This should be considered a bug in PHP (as it is used in the default configuration).

Of course it can be reconfigured. But how do you suggest escaping when the 
configuration file is not accessible (while it usualy isn't)?

Don't shoot the messenger... 

If PHP generates, by default, broken markup and most people cannot change this (wrong) setting, PHP 
is broken and should be fixed.

This has nothing to do with the validator.

In other words, your question about "how to escape when the configuration file is not accessible" would 
be best asked to the php developers, not here. 

ini_set("arg_separator.output","&");(In reply to comment #0)
> PHP automatically adds &PHPSESSID at the end of the url's if cookies are not 
> supported. This prevents sites from validating. While this doesn't appear on 
> normal browser it does for the validator page. I think &PHPSESSID should be 
> ignored while parsing.

ini_set("arg_separator.output","&");
I use this and it fixs it for me.