The connection string builder lets developers programmatically create syntactically correct connection strings, and parse and rebuild existing connection strings, using properties and methods of the class. The connection string builder provides strongly typed properties corresponding to the known key/value pairs allowed by OLE DB connections, and developers can add arbitrary key/value pairs for any other connection string values. The OleDbConnectionStringBuilder class implements the ICustomTypeDescriptor interface. This means that the class works with Visual Studio .NET designers at design time. When developers use the designer to build strongly typed DataSets and strongly typed connections within Visual Studio .NET, the strongly typed connection string builder class will display the properties associated with its type and will also have converters that can map common values for known keys.
Developers needing to create connection strings as part of applications can use the OleDbConnectionStringBuilder class to build and modify connection strings. The class also makes it easy to manage connection strings stored in an application configuration file. The OleDbConnectionStringBuilder performs checks only for the limited set of known key/value pairs. Therefore, this class can be used to create invalid connection strings. The following table lists the known keys and their corresponding properties within the OleDbConnectionStringBuilder class, and their default values. Besides these specific values, developers can add any key/value pairs to the collection that is contained within the OleDbConnectionStringBuilder instance:
The Item property handles attempts to insert malicious entries. For example, the following code, using the default Item property (the indexer, in C#) correctly escapes the nested key/value pair:
Dim builder As _
New System.Data.OleDb.OleDbConnectionStringBuilder
builder("Provider") = "Microsoft.Jet.OLEDB.4.0"
builder("Data Source") = "C:\Sample.mdb"
builder("User Id") = "Admin;NewValue=Bad"
System.Data.OleDb.OleDbConnectionStringBuilder builder =
new System.Data.OleDb.OleDbConnectionStringBuilder();
builder["Provider"] = "Microsoft.Jet.OLEDB.4.0";
builder["Data Source"] = "C:\\Sample.mdb";
builder["User Id"] = "Admin;NewValue=Bad";
The result is the following connection string that handles the invalid value in a safe manner:
Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\Sample.mdb;User ID="Admin;NewValue=Bad"