Oops, that should be letters, digits 0-9 and the - character (neither the first nor the last character can be -).
You'll never be able to have an & though no matter how hard you stamp your foot (are you my daughter ) - the & character has a special meaning in a web address. If you really wanted to you could exploit that special meaning to use an address like
www.example.com/?janet&john
... but it would not be a very good idea.