What the validator suggests:

Ampersands (&'s) in URLs

Another common error occurs when including a URL which contains an ampersand ("&"):

<!-- This is invalid! --> <a href="foo.cgi?chapter=1&section=2&copy=3&lang=en">...</a>

This example generates an error for "unknown entity section" because the "&" is assumed to begin an entity reference. Browsers often recover safely from this kind of error, but real problems do occur in some cases. In this example, many browsers correctly convert &copy=3 to ©=3, which may cause the link to fail. Since &lang; is the HTML entity for the left-pointing angle bracket, some browsers also convert &lang=en to 〈=en. And one old browser even finds the entity &sect;, converting &section=2 to §ion=2.

To avoid problems with both validators and browsers, always use & amp; in place of & when writing URLs in HTML:

<a href="foo.cgi?chapter=1& amp;section=2& amp;copy=3& amp;lang=en">...</a>

Note that replacing & with & amp; is only done when writing the URL in HTML, where "&" is a special character (along with "<" and ">"). When writing the same URL in a plain text email message or in the location bar of your browser, you would use "&" and not "& amp;". With HTML, the browser translates "& amp;" to "&" so the Web server would only see "&" and not "& amp;" in the query string of the request.

Edit: *sigh*, encoding changed