The "&" is not a special character in MySQL, so does not need to be escaped as far as it is concerned. (If using some other DBMS, it would probably be a good idea to let us know what you are using.)
"&" is a special character in HTML/XHTML/XML, so you may need to escape it when outputting content to the browser. In that case you can use htmlspecialchars(), but that has nothing to do with the database (and in general I recommend against using htmlspecialchars() or htmlentities() when inserting text into the database, as that can screw up searches, may cause the text to become too large to fit in the field, and in general may mess up future uses you my come up with for that data, or cause double-escaping if some other piece of your application uses the data and also applies htmlspecialchars() when outputting it.)
