Take the 2-minute tour ×

In a web application we develop we generate SQL Server CE database files and for those we also generate passwords. The passwords are generated using System.Web.Security.Membership.GeneratePassword().

I assumed that GeneratePassword generated suitable password strings since it uses letters, digits and symbols. On http://msdn.microsoft.com/en-us/library/aa257373(v=sql.80).aspx I find a vague statement that SQL Server CE passwords "Can contain letters, symbols, digits, or a combination."

But today a password was generated that made it impossible to create the database because the connection string apparently had invalid characters. "&" to be precise.

I've searched the net for a complete list of characters to make a white-list cleaning function, but cannot find any such info.

Does anyone have such a list of valid characters for SQL Server CE passwords?

share|improve this question
add comment

2 Answers

I ended up having to make my own simple password generator. Blogged HERE

Looks like you have an XML issue. XML (or web.config) special characters are:

  1. quot "
  2. amp &
  3. apos '
  4. lt <
  5. gt >


Also, if you are requiring strong passwords they must contains characters from at least three of the following categories:

  1. English uppercase characters (A through Z)
  2. English lowercase
  3. characters (a through z) Base 10 digits (0 through 9) Nonalphabetic
  4. characters (for example: !, $, #, %)
share|improve this answer
The link is broken. Can you provide a code sample. –  Steve Mar 23 '12 at 13:20
@Steve The blog link is now fixed, sorry about that. –  JBrooks Mar 23 '12 at 14:42
add comment

I wonder whether you need to use an escaped character for the ampersand.

share|improve this answer
Yes, sounds like a connection string/.config/xml issue rather than a password issue –  ErikEJ Feb 19 '11 at 15:33
add comment

Your Answer


