I know this is an old post, but try adding addslashes() to your php var:
$companyName = addslashes("one & second");
Then, when php parses '&' (ampersand), it reads '\ &' (backslash-ampersand) instead of trying to create a link in the middle of the request.
source share