Escape is set to \
by default, so you don't need to set it; but if you do, don't wrap it in quotes.
Ampersand is the SQL*Plus substitution variable marker; but you can change it, or more usefully in your case turn it off completely, with:
set define off
Then you don't need to bother escaping the value at all.