In my AppSettings in web.config, I have something like this:
Replace & with & (escape it):
&
That's the common requirement for any valid XML file.
See Where can I get a list of the XML document escape characters?