Do I really need to encode '&' as '&'?

Yes. Just as the error said, in HTML, attributes are #PCDATA meaning they’re parsed. This means you can use character…
https://www.widecoder.com/do-i-really-need-to-encode-as/