Is using html entities ampersand (&) and apostrophe (') in urlencoded link strings legal in music playlists?

Question

I'm urlencoding song links in *.m3u8 and *.xspf playlists. To be honest, I don't trust 'utf-8' without bom to preserve non-ascii characters, especially in links. I also have some *awkward* special characters, square brackets, for instance, in a song title. In the case of *.m3u8 files, adding the BOM poses a problem, since VLC player (on Windows), which many use, reads the marker as a track 0 and pops up an error.

So without BOM ...

The links in the playlists are urlencoded. I do this by hand, or I batch process the *.m3u8 files. Spiff *.xspf formatted playlists are a trifle more difficult to do by hand. Fortunately VLC exports ready-made *.xspf lists from *.m3u8 lists. Also urlencoded links. (Unicode without BOM is simply too unreliable for media players, I assume.) What I've noticed is this :

Encoded characters & and ' are rendered & and ' respectively. By VLC. The links work in the player, opened from both *.m3u8 and *.xspf, but is VLC in error? There are thousands of media players now. Some may well choose not to read & as %26 and ' as %27. What is the best practice in playlists? Is there a best practice, a statistical formula? How did VLC decide to implement html entities rather than urlencoded?

It is tempting to convert all instances of & and ' to their proper urlencoded values.

I hope someone also has experience with this feature and can provide a good answer.

Mine would be, tentatively, "yes, urlencode ampersands and apostrophes". Note that VLC might target a few extra characters. I don't know. Perhaps, the question mark, the dollar sign -- I don't know. (No songs with $ or ? in the titles to test VLC.) I'm using VLC 3.0.11 Vetinari, but the way, Windows 10. From research on obscure forums my impression is that VLC switched to urlencoding generated playlist links to tracks by default in version 3. Before links were unencoded in UTF-8, ie. *.m3u8, files, I think.

Below are the correct codes:

# | %23
$ | %24
% | %25
& | %26
' | %27
( | %28*
) | %29*
* | %2A
+ | %2B*
, | %2C*
- | %2D*
. | %2E*
/ | %2F*

? | %3F

I have asterisked the ones I leave as-is, *unconverted*, in my playlists. Square brackets, %5B and %5D, of necessity must be urlencoded, or it breaks the links.