How are special characters handled in an oData query?

Do not use the “JavaScript String replace() Method”. It will replace the first occurrence of the special characters. if you have 2 occurence of the same special characters in the filtering parameter, it will fail. So use the regular expression to replace the characters.

function replaceSpecialCharacters(attribute) {
  // replace the single quotes
     attribute = attribute.replace(/'/g, "''");

     attribute = attribute.replace(/%/g, "%25");
     attribute = attribute.replace(/\+/g, "%2B");
     attribute = attribute.replace(/\//g, "%2F");
     attribute = attribute.replace(/\?/g, "%3F");

     attribute = attribute.replace(/#/g, "%23");
     attribute = attribute.replace(/&/g, "%26");
     return attribute;
}

Also pay attention, since the replacements also contains % then % it self should be replaced at beginning

Here is a list of characters that should be encoded prior to sending to SQL server over HTTP:

http://msdn.microsoft.com/en-us/library/aa226544(SQL.80).aspx

Yes, the '&' symbol is one of them.