I assume you want to use the ampersand literally in the query string and not as an argument separator. In which case you could use the functions urlencode /urldecode. Which will encode the query string so you could avoid PHP treating an ampersand value as an argument separator.
http://www.php.net/urlencode
http://www.php.net/urldecode
So essentially you pass the $variable to your link like this:
<a href="xxx.php?category=<%print urlencode($cat);%>&subCat=<%print urlencode($subCat);%>"><% print urlencode($cat.$subCat); %>
And then pass the string back through urldecode.
ASP-style delimiters are a bad idea..
Here is an FAQ that I wrote that discusses why as well as how to use a standards-compliant url-embedded argument separator:
http://p2p.wrox.com/topic.asp?TOPIC_ID=4028
: )
Rich
:::::::::::::::::::::::::::::::::
Smiling Souls
http://www.smilingsouls.net
:::::::::::::::::::::::::::::::::