In MessageML, you will need to escape the ampersand character (&) to (&).

<messageML>
<a href="https://google.com?a=1&amp;b=2">link</a>
</messageML>

If you are using Symphony's BDKs, there are helper classes to help you do this automatically to sanitize content that you believe might contain special characters.

// Java BDK
import com.symphony.bdk.core.service.message.util.MessageUtil;

public void doWork() {
    String escaped = MessageUtil.escapeSpecialChars("Hello <b>World</b> A&W's are great!");
    // Hello &lt;b&gt;World&lt;/b&gt; A&amp;W&apos;s are great!
}

# Python BDK
from symphony.bdk.core.service.message.messageml_util import escape_special_chars

public void doWork() {
    escaped = escape_special_chars("Hello <b>word</b> A&W's are great!")
    # Hello &lt;b&gt;World&lt;/b&gt; A&amp;W&apos;s are great!
}

You can refer to the MessageML documentation for complete details on message format: https://docs.developers.symphony.com/building-bots-on-symphony/messages/overview-of-messageml/message-format-messageml#xml-formatting