diff --git src/bp-core/bp-core-classes.php src/bp-core/bp-core-classes.php
index d79c92f..877e3ad 100644
--- src/bp-core/bp-core-classes.php
+++ src/bp-core/bp-core-classes.php
@@ -368,7 +368,7 @@ class BP_User_Query {
 		// 'search_terms' searches user_login and user_nicename
 		// xprofile field matches happen in bp_xprofile_bp_user_query_search()
 		if ( false !== $search_terms ) {
-			$search_terms = bp_esc_like( $search_terms );
+			$search_terms = bp_esc_like( wp_kses_normalize_entities( $search_terms ) );
 
 			if ( $search_wildcard === 'left' ) {
 				$search_terms_nospace = '%' . $search_terms;
diff --git src/bp-templates/bp-legacy/buddypress-functions.php src/bp-templates/bp-legacy/buddypress-functions.php
index e9c1acd..b119288 100644
--- src/bp-templates/bp-legacy/buddypress-functions.php
+++ src/bp-templates/bp-legacy/buddypress-functions.php
@@ -536,7 +536,7 @@ function bp_legacy_theme_ajax_querystring( $query_string, $object ) {
 
 	$object_search_text = bp_get_search_default_text( $object );
  	if ( ! empty( $_POST['search_terms'] ) && $object_search_text != $_POST['search_terms'] && 'false' != $_POST['search_terms'] && 'undefined' != $_POST['search_terms'] )
-		$qs[] = 'search_terms=' . $_POST['search_terms'];
+		$qs[] = 'search_terms=' . urlencode( $_POST['search_terms'] );
 
 	// Now pass the querystring to override default values.
 	$query_string = empty( $qs ) ? '' : join( '&', (array) $qs );
diff --git src/bp-xprofile/bp-xprofile-functions.php src/bp-xprofile/bp-xprofile-functions.php
index 0387bd3..beffd5b 100644
--- src/bp-xprofile/bp-xprofile-functions.php
+++ src/bp-xprofile/bp-xprofile-functions.php
@@ -685,7 +685,7 @@ function bp_xprofile_bp_user_query_search( $sql, BP_User_Query $query ) {
 
 	$bp = buddypress();
 
-	$search_terms_clean = bp_esc_like( $query->query_vars['search_terms'] );
+	$search_terms_clean = bp_esc_like( wp_kses_normalize_entities( $query->query_vars['search_terms'] ) );
 
 	if ( $query->query_vars['search_wildcard'] === 'left' ) {
 		$search_terms_nospace = '%' . $search_terms_clean;
diff --git tests/phpunit/testcases/core/class-bp-user-query.php tests/phpunit/testcases/core/class-bp-user-query.php
index 0c2eb97..46fda6c 100644
--- tests/phpunit/testcases/core/class-bp-user-query.php
+++ tests/phpunit/testcases/core/class-bp-user-query.php
@@ -201,6 +201,23 @@ class BP_Tests_BP_User_Query_TestCases extends BP_UnitTestCase {
 		$this->assertEquals( $user_id, $found_user_id );
 	}
 
+	public function test_bp_user_query_search_with_ampersand_sign() {
+
+		// LIKE special character: &
+		$user_id = $this->create_user();
+		xprofile_set_field_data( 1, $user_id, "a&mpersand" );
+		$q = new BP_User_Query( array( 'search_terms' => "a&m", ) );
+
+		$found_user_id = null;
+		if ( ! empty( $q->results ) ) {
+			$found_user = array_pop( $q->results );
+			$found_user_id = $found_user->ID;
+		}
+
+		$this->assertEquals( $user_id, $found_user_id );
+
+	}
+
 	/**
 	 * @group search_terms
 	 */