Finally, when you are building your test data, don't limit yourself to file/folder names with just the ampersand. Be sure to include additional test cases with the greater-than sign (>), the less-than sign (<), the vertical bar (|), unbalanced left and right parentheses "(" and ")", the cap/hat (^), the percent sign (%) - URLs are a favorite, and the exclamation point (!).
For non-file/folder name inputs, include test cases with both balanced and unbalanced quotation marks (") as well.