Ok, two thoughts on this. I'm not sure if they'll lead you to your answer, or to more confusion - if the latter, my apologies in advance.
1) Still not sure of the data type of the field you're storing this in, but generally doing this substitution is adding a ton more characters into your table than you probably want. I'd recommend storing the text 'as is' (after you've stripped slashes, validated, etc.), and having your PHP do the work to display the text instead.
and, if you still want to go that route,...
2) try & amp;nbsp (removing the space between the & and the "amp" - the vB code wouldn't display it properly, sorry) as your substituion character set. My thought is that the ampersand char isn't getting parsed properly when it's passed back to PHP without the semi-colon.
Hope this helps!