Since this is part of an HTML document you should escape the & by replacing it by &
An ampersand '&' in HTML mark the start of a character reference entity such as < > and é
Literal ampersands in your document should be written as &
Note that if that code is generated dynamical you should also escape the URL so that it can appear in a javascript string as well.
Edited: I can confirm this particular problem occurs when pasting javascript code directly in the address bar. It seems HTML character escaping rules are irrelevant here after all.
I've googled a bit and found this blog post which identify that particular behavior as an ie bug.