I think the update to
protect.inc.php is the raison d'être of MODX 1.0.6, so it would be better to investigate the reason for the error rather than work around it. Deleting the ampersand will change the way the code is working. First thing to check is what version of PHP you are using - possibly you are seeing behaviour from an older version?
I'm not super expert with PHP either, I just use it a lot, so a real expert may correct me here: Most often, an ampersand before a variable name is used to pass an argument (e.g. a function parameter) "by reference", rather than "by value". Without the ampersand, a function uses its own copy of the parameter. With it, the function updates the original variable, similar to using a global variable.
(Lots on this in the
PHP manual)
Things are already getting more complicated when you consider ampersands within foreach loops, but I think the main point of this one is to update the actual elements of the array, not just use values from it. See
http://php.net/manual/en/control-structures.foreach.php.
;) KP