How do I escape ampersands in XML so they are rendered as entities in HTML?

As per §2.4 of the XML 1.0 spec, you should be able to use &.

I tried & but this isn't allowed.

Are you sure it isn't a different issue? XML explicitly defines this as the way to escape ampersands.

When your XML contains &, this will result in the text &.

When you use that in HTML, that will be rendered as &.

The & character is itself an escape character in XML so the solution is to concatenate it and a Unicode decimal equivalent for & thus ensuring that there are no XML parsing errors. That is, replace the character & with &.