“&” displaying as “&”

You should always prevent special characters in filenames, this can lead to strange behavior. Specifically because certain characters can be part of a query string (example.com/index.php?var1=value1&var2=value2).

I recommend the Transliteration module (assuming Drupal 7) to remove these charaters form the filename. If that does not help (or if you are using Drupal 8), you might want to take another look at you upload configuration. There might be a token provided by File (Field) Paths that does provide you with a good encoded name.