First, let's be clear, this is not a SharePoint issue, it's an HTTP
standard issue. I don't think you're able to upload files with & or %
in their names to Apache or Websphere or anything. Consider the issue
with &, in a URL that signals a parameter (actually a parameter after
the first one). Now let's see how a web server would handle a name with
& in it. Should it consider that as part of the filename, or a
parameter? % has the same problem, that's used to denote special
characters. You need something to "HTMLEncode" the filenames. That is
a standard method in .net, so it should be very easy to write. Heck, I
can't program my way out of a wet paper bag and I could probably write
it.