The XML file must use proper "escaping". So a "&" character isn't a valid "standalone" character in a properly formed XML file. The proper escaping for the "&" character is "&".
There are 5 "escape" characters in total:
" "' '< <> >& &