The character breaks passwords that are stored in the web.config

web.config

password security

special characters

web development

ASP.NET

The character breaks passwords that are stored in the web.config

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design

Security & Auth C# & .NET

Introduction

Special characters like &, <, >, ", and ' break passwords stored in web.config because the file is XML. These characters have special meaning in XML and must be escaped with XML entities (e.g., & for &). If you store a password like P@ss&word directly in web.config, the XML parser interprets & as the start of an entity reference and fails to parse the file, causing your application to crash on startup.

The Problem

xml

1<!-- web.config — THIS BREAKS -->
2<connectionStrings>
3  <add name="MyDB"
4       connectionString="Server=db;Database=app;User=admin;Password=P@ss&word" />
5</connectionStrings>
6<!-- XML parser error: '&' is not a valid start of an entity reference -->

The XML parser sees &word and tries to interpret it as an XML entity (like & or <). Since &word; is not a valid entity, parsing fails.

XML Special Characters and Their Escapes

Character	XML Entity	Description
`&`	`&`	Ampersand
`<`	`<`	Less than
`>`	`>`	Greater than
`"`	`"`	Double quote
`'`	`'`	Single quote (apostrophe)

Fix 1: Escape Special Characters

xml

1<!-- Replace & with &amp; -->
2<connectionStrings>
3  <add name="MyDB"
4       connectionString="Server=db;Database=app;User=admin;Password=P@ss&amp;word" />
5</connectionStrings>
6
7<!-- Multiple special characters -->
8<!-- Password: <admin&"pass> -->
9<add name="MyDB"
10     connectionString="Server=db;Password=&lt;admin&amp;&quot;pass&gt;" />

The XML parser converts entities back to their characters when reading the value, so the actual password used at runtime is P@ss&word.

Fix 2: Use CDATA Section

xml

1<!-- CDATA sections treat content as raw text — no escaping needed -->
2<appSettings>
3  <add key="ApiPassword" value="" />
4</appSettings>
5
6<!-- Unfortunately, CDATA does NOT work inside XML attributes -->
7<!-- This is INVALID: -->
8<!-- <add key="x" value="<![CDATA[P@ss&word]]>" /> -->
9
10<!-- CDATA only works in element content: -->
11<customSettings>
12  <password><![CDATA[P@ss&word<>"'!]]></password>
13</customSettings>

CDATA is useful for custom config sections where you control the XML structure, but it cannot be used in attribute values (which is how standard appSettings and connectionStrings store data).

Fix 3: Store Encrypted Passwords

bash

# Encrypt the connectionStrings section using ASP.NET tools
aspnet_regiis -pe "connectionStrings" -app "/MyApp" -prov "DataProtectionConfigurationProvider"

xml

1<!-- Before encryption -->
2<connectionStrings>
3  <add name="MyDB" connectionString="...Password=P@ss&amp;word" />
4</connectionStrings>
5
6<!-- After encryption — no special character issues -->
7<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
8  <EncryptedData>
9    <CipherData>
10      <CipherValue>AQAAANCMnd8BFd...long encrypted string...</CipherValue>
11    </CipherData>
12  </EncryptedData>
13</connectionStrings>

ASP.NET automatically decrypts at runtime. This solves both the special character problem and the security concern of plaintext passwords.

Fix 4: Use Environment Variables or User Secrets

xml

1<!-- Reference an environment variable -->
2<appSettings>
3  <add key="DbPassword" value="%DB_PASSWORD%" />
4</appSettings>

csharp

1// .NET Core / .NET 5+ — use User Secrets (development) or env vars (production)
2// No web.config needed for secrets
3
4// appsettings.json (no XML escaping issues — it's JSON)
5{
6  "ConnectionStrings": {
7    "MyDB": "Server=db;Password=P@ss&word"
8  }
9}
10
11// Or environment variable
12// DB_PASSWORD=P@ss&word (no escaping needed in env vars)
13var password = Environment.GetEnvironmentVariable("DB_PASSWORD");

Fix 5: URL-Encode in Connection Strings

Some database drivers accept URL-encoded values:

xml

1<!-- URL-encode the password portion -->
2<!-- P@ss&word → P%40ss%26word -->
3<add name="MyDB"
4     connectionString="Server=db;Database=app;User=admin;Password=P%40ss%26word" />

This depends on the database driver supporting URL-encoded connection strings. SQL Server's SqlClient does not URL-decode — use XML escaping instead.

Common Special Character Passwords

xml

1<!-- & (ampersand) — most common issue -->
2Password=P@ss&amp;word
3
4<!-- < and > (angle brackets) -->
5Password=&lt;secret&gt;
6
7<!-- " (double quote) inside an attribute -->
8Password=my&quot;pass&quot;word
9
10<!-- Multiple special chars: R&D<>team"pass" -->
11Password=R&amp;D&lt;&gt;team&quot;pass&quot;
12
13<!-- @ does NOT need escaping (not special in XML) -->
14Password=user@domain
15
16<!-- # does NOT need escaping -->
17Password=pass#123

Programmatic Config Access

csharp

1// Reading the value — ASP.NET handles unescaping automatically
2string connStr = ConfigurationManager.ConnectionStrings["MyDB"].ConnectionString;
3// Returns: "Server=db;Database=app;User=admin;Password=P@ss&word"
4// The &amp; is automatically converted to & when read
5
6// Writing config programmatically (escaping is automatic)
7var config = WebConfigurationManager.OpenWebConfiguration("~");
8var section = config.ConnectionStrings.ConnectionStrings["MyDB"];
9section.ConnectionString = "Server=db;Password=P@ss&word";
10config.Save();  // Automatically writes &amp; in the XML

Common Pitfalls

Double-escaping: If you write &amp; in web.config, the application reads & (not &) as the password. Only escape once — use & in XML to get & at runtime.
Forgetting & in connection strings: Server=db;User=admin&Password=pass is not a valid connection string anyway (semicolons separate parts, not ampersands), but if your password contains &, it must be escaped as &.
CDATA in attributes: <add value="<![CDATA[text]]>" /> does not work — CDATA is only valid in element content, not attributes. The literal string <![CDATA[text]]> becomes the value.
Editing with text editors that auto-escape: Some editors double-escape when you save. If you type & and the editor saves &amp;, your password breaks. Use Visual Studio's config editor or verify the raw XML.
Encrypted sections with special chars: Encrypt the section before adding special characters to avoid escaping issues entirely. aspnet_regiis handles escaping internally during encryption.

Summary

XML special characters (&, <, >, ", ') must be escaped in web.config values
Use & for &, < for <, > for >, " for "
ASP.NET automatically unescapes XML entities when reading config values at runtime
Encrypt connection strings with aspnet_regiis to avoid escaping and improve security
In .NET Core/.NET 5+, use appsettings.json (JSON) or environment variables to avoid XML escaping entirely
Only escape once — double-escaping causes the escaped characters to appear in the actual password

System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course

Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design

The character breaks passwords that are stored in the web.config

System Design practice on Codemia

Introduction

The Problem

XML Special Characters and Their Escapes

Fix 1: Escape Special Characters

Fix 2: Use CDATA Section

Fix 3: Store Encrypted Passwords

Fix 4: Use Environment Variables or User Secrets

Fix 5: URL-Encode in Connection Strings

Common Special Character Passwords

Programmatic Config Access

Common Pitfalls

Summary

Related reading

System Design Fundamentals

Track what you have practised

System Design practice on Codemia