& replace &

var decoded = encoded.replace(/&/g,'&');

http://stackoverflow.com/questions/3700326/decode-amp-back-to-in-javascript

Technically, and often in practice, the up-voted answer is not correct.

Uri.EscapeUriString or HttpUtility.UrlPathEncode is the correct way to escape a string meant to be part of a URL.

Take for example the string "Stack Overflow":

• HttpUtility.UrlEncode("Stack Overflow") --> "Stack+Overflow"

• Uri.EscapeUriString("Stack Overflow") --> "Stack%20Overflow"

• Uri.EscapeDataString("Stack + Overflow") --> Also encodes "+" to "%2b" ---->Stack%20%2B%20%20Overflow