I dont know what you are doing with your shortcode but it is good practice to serialize and parse data so that it displays beautifully.
Since you need to look for & and not for & just use $data = str_replace("&", "&", $data). Also you could look in the php manual for urldecode() and urlencode().
Read the note there:
Be careful about variables that may match HTML entities. Things like &, © and £ are parsed by the browser and the actual entity is used instead of the desired variable name. This is an obvious hassle that the W3C has been telling people about for years. The reference is here: ยป http://www.w3.org/TR/html4/appendix/notes.html#h-B.2.2.
PHP supports changing the argument separator to the W3C-suggested semi-colon through the arg_separator .ini directive. Unfortunately most user agents do not send form data in this semi-colon separated format. A more portable way around this is to use & instead of & as the separator. You don’t need to change PHP’s arg_separator for this. Leave it as &, but simply encode your URLs using htmlentities() or htmlspecialchars().
I hope this sheds some light onto your question.