chr(38)
should work independent of the platform.
However, if you are using SQL*Plus, then you could use the sqlplus command:
set define off
In SQL*Plus, ampersand is used for substitution variable. The above command will ignore it.
For example,
SQL> SET DEFINE OFF
SQL> SELECT 'user.password&user.user_name' FROM DUAL;
'USER.PASSWORD&USER.USER_NAM
----------------------------
user.password&user.user_name
SQL>
Well, of course,chr(38) will work too:
SQL> SELECT 'user.password'||chr(38)||'user.user_name' FROM dual;
'USER.PASSWORD'||CHR(38)||'U
----------------------------
user.password&user.user_name
SQL>