ConnectionString密码-XML转义

Question

I have a strong password that I am having some trouble to put it on my web.config:

So my web.config entry is:

<add name="MyConnectionString" connectionString="Data Source=tcp:xxxxxx.database.windows.net,1433;Initial Catalog=MyDatabase;MultipleActiveResultSets=true;User ID=xxxxxx@xxxxxxxx;Password=MyPassword" providerName="System.Data.SqlClient" />

And my strong password is:

<=#}U}2{p^07>7u10)'*g7|5=96!;a1F2="=!,}7;65\\3{9P0w(#/]${06|S /L2=l{0[2E32+78AJ|@;9}$N=|(0s9,=\\N|o+t

So the issue is related with some character that need to be escaped, but I tried with no success to escape it using single quotes.

Thanks

Answer 1

Allow system to handle this for you:

Console.WriteLine(
    new XElement("add",
        new XAttribute("name","MyConnectionString"),
        new XAttribute("connectionString",
            new SqlConnectionStringBuilder {
                DataSource="tcp:xxxxxx.database.windows.net,1433",
                InitialCatalog="MyDatabase",
                MultipleActiveResultSets=true,
                UserID="xxxxxx@xxxxxxxx",
                Password=Console.ReadLine()
            }
        ),
        new XAttribute("providerName","System.Data.SqlClient")
    )
);

Answer 2

I tried with no success to escape it using single quotes

What that doesn't actually escape anything - it just allows you to have a double-quote as part of your value. But then it means you can't have an apostrophe as part of your value... it's probably simpler to turn both into entity representations... along with < and & .

So in this case you want:

<=#}U}2{p^07>7u10)'*g7|5=96!;a1F2="=!,}7;65\3{9P0w(#/]${06|S /L2=l{0[2E32+78AJ|@;9}$N=|(0s9,=\N|o+t

If you had an & in your original password, you'd convert that to & .

Or for more simplicity, when you're generating a password, force it to not have any characters that will require escaping. (Or move to a different authentication model, of course...)

Or come up with this programmatically, as per PetSerAl's answer, of course.

Answer 3

Agree with @PetSerAl that you should just use a high-level API to create your XML for you. But if you must format your XML text manually, the SecurityElement class has utilities to escape and unescape XML text:

        string password = @"<=#}U}2{p^07>7u10)'*g7|5=96!;a1F2=""=!,}7;65\3{9P0w(#/]${06|S /L2=l{0[2E32+78AJ|@;9}$N=|(0s9,=\N|o+t";

        var xmlText = System.Security.SecurityElement.Escape(password); // Escape invalid XML characrers.

        var passwordBack = new System.Security.SecurityElement("tag", xmlText).Text;  // Unescape them again.

        Debug.Assert(passwordBack == password); // No assert