Allowed character for SQL Server CE password?

Question

In a web application we develop we generate SQL Server CE database files and for those we also generate passwords. The passwords are generated using System.Web.Security.Membership.GeneratePassword().

I assumed that GeneratePassword generated suitable password strings since it uses letters, digits and symbols. On http://msdn.microsoft.com/en-us/library/aa257373(v=sql.80).aspx I find a vague statement that SQL Server CE passwords "Can contain letters, symbols, digits, or a combination."

But today a password was generated that made it impossible to create the database because the connection string apparently had invalid characters. "&" to be precise.

I've searched the net for a complete list of characters to make a white-list cleaning function, but cannot find any such info.

Does anyone have such a list of valid characters for SQL Server CE passwords?

Answer 1

I ended up having to make my own simple password generator. Blogged HERE

Looks like you have an XML issue. XML (or web.config) special characters are:

1. quot "
2. amp &
3. apos '
4. lt <
5. gt >

Also, if used in an OLE DB or ODBC connection string, a login or password must not contain the following characters: [] {}() , ; ? * ! @.

Also, if you are requiring strong passwords they must contains characters from at least three of the following categories:

1. English uppercase characters (A through Z)
2. English lowercase
3. characters (a through z) Base 10 digits (0 through 9) Nonalphabetic
4. characters (for example: !, $, #, %)