You need to either turn &
into its entity &
, or wrap the contents in CDATA tags.
If you choose the entity route, there are additional characters you need to turn into entities:
> >
< <
' '
" "
Background: Beware of the ampersand when using XML
Wikipedia: List of XML character entity references