Answer
Build the string using the ASCII/CHR function for the ampersand instead of typing the character literally — for example, WHERE name = 'Dungeons ' || chr(38) || ' Dragons' — since Quick Report's own SQL parser intercepts a literal & anywhere in the statement as a substitution-parameter marker rather than passing it through as a plain character. Concatenating chr(38) in place of the literal & character avoids that interception entirely.