Andrea <andrea-dev@hotmail.com> writes:

> ob-sql.el has a function org-babel-execute:sql. This function extracts
> the password to connect to your database of choice as dbpassword.
> It then uses it like this:
>
>     (if dbpassword
> 	(format "PGPASSWORD=%s " dbpassword)
>       "")
>
> If the password contains an & character, the execution of a block fails.

Thanks for reporting!
May you please try the attached patch?