You're very light on the details. How are you outputting to a file? If you're generating XML from text, you'll need to encode a few characters including &.

Functions that return XML should return "&"
Functions that return text should return "&"