Thanks for all your help...
Dan, I have tried that NCR - the problem persists though.
Also, the name attribute has been declared as CDATA - sorry that I did not mention that
Anyway - I have solved the problem - although I have done in a really messy adhoc way.
I just replaced all instances of & with my own made up character replacement - I used [AMP]
Then - In the PHP which parses the XML I used str_replace on the URL attribute to replace all instances of [AMP] with &
$attribs['url'] = str_replace('[AMP]','&',$attribs['url']); // <-- Replaces [AMP] with &
It's so odd that I have to do this for it to work!