How do I escape an ampersand in a javascript string so that the page will validate strict?

Try putting your javascript inside a CDATA block like this:

<script type="text/javascript">
<![CDATA[
// content of your Javascript goes here
]]>
</script> 

which should make it pass validation. To be extra safe you can add Javascript comments around the CDATA tags to hide them from older browsers who don’t understand the CDATA tag:

<script type="text/javascript">
/* <![CDATA[ */
// content of your Javascript goes here
/* ]]> */
</script>