With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle (SQL*Plus) but cannot seem to find an issue with the ampersand. I've referenced multiple cheat sheets and articles, and cannot find a reference to it (other than Oracle).
Technically yes, but no more so than any other T-SQL syntax. The & is used for bitwise actions, and if there is an applicable SQL injection vulnerability found, an attacker could use it to probe for more information about the structure of the query/data, but it's a very specialized scenario, and, in my opinion, a very low priority. I can think of many more reasons to whitelist an ampersand than I can to blacklist it.
See the link below for more documentation about the operator.