I can never remember this piece of code to encode ASP.NET output:
server.HtmlEncode(string)
or
httpUtility.htmlEncode(string)
If this is a VB app, you'll need to set a reference to SYSTEM.WEB and use the second example.
This is code that wil change 'D&B' into 'D&B', so that you can load it into an XML doc.