Why Ampersand should be escaped because of XSS injection
<p>The five characters that OWASP recommend escape to prevent XSS injections are 
<code>&amp;</code>, <code>&lt;</code>, <code>&gt;</code>, <code>"</code>, <code>'</code>.</p>

<p>Among them, I cannot understand why <code>&amp;</code>(ampersand) should be escaped and how it can be used as a vector to inject script. Can somebody give an example that all the other four characters that are escaped but ampersand is not so there will be XSS injection vulnerability. </p>

<p>I have checked the other question but that answer really does not make things any clearer.</p>