Man... dealing with & (ampersands) in SOA, web services, XML, and REST sucks.
Dealing with special characters in general sucks-having to figure out if the
product or tool is escaping/encoding them for you or not.
Recently, I had to update my BPEL process to replace every occurrence of &