Snib,
It isn't the ampersand character that isn't allowed, it's the fact that it is inserted unencoded. HTML entities must be encoded when they appear literally in a document. The W3C recommends that a semi-colon be used instead of the ampersand to separate URL embedded arguments, php.net recommends the encoded HTML entity.. & which is what I use personally.

I wrote an article on this a long time ago:
http://p2p.wrox.com/topic.asp?TOPIC_ID=4028

This includes all the proper ini settings and relevant links that discuss query strings and the argument separator.

Regards,
Rich

::::::::::::::::::::::::::::::::::::::::::
The Spicy Peanut Project
http://www.spicypeanut.net
::::::::::::::::::::::::::::::::::::::::::