The only way to be certain that an ISO 8859-1 compliant web client will show an & sign is to use the ASCII escape sequence &.