Replace & with &

It looks like the function returning an url, And is always good practice to use esc_url(); wordpress function to escape all characters including the – & into & before displaying.

Example usage –

return esc_url( $incomingLink );