SQL Server connection string format
Server=myserver;Database=Shop;User ID=app;Password=secret;Encrypt=TrueExamples
| Case | Connection string |
|---|---|
| LocalDB (Visual Studio) | Server=(localdb)\MSSQLLocalDB;Database=Shop;Trusted_Connection=True |
| SQL Express, Windows authentication | Server=.\SQLEXPRESS;Database=Shop;Integrated Security=True;TrustServerCertificate=True |
| Docker (mcr.microsoft.com/mssql/server) | Server=localhost,1433;Database=Shop;User ID=sa;Password=Your_password123;TrustServerCertificate=True |
| Azure SQL with Microsoft Entra (managed identity or developer login) | Server=tcp:myserver.database.windows.net,1433;Database=Shop;Authentication=Active Directory Default;Encrypt=True |
| Azure SQL with a SQL login | Server=tcp:myserver.database.windows.net,1433;Database=Shop;User ID=app;Password=secret;Encrypt=True |
| Several result sets on one connection (MARS) | Server=localhost;Database=Shop;Integrated Security=True;TrustServerCertificate=True;MultipleActiveResultSets=True |
Every example on this page is checked with Microsoft.Data.SqlClient itself. Replace the passwords with your own, and keep real ones out of source control.
"The certificate chain was issued by an authority that is not trusted"
Microsoft.Data.SqlClient 4.0 turned Encrypt on by default. A local or Docker SQL Server has a self-signed certificate, so the TLS handshake fails. For development, add TrustServerCertificate=True; in production, install a trusted certificate and leave it off. Encrypt=False also works, but sends everything in clear text.
Ports and instances
SqlClient has no Port keyword. Put the port after the server with a comma, Server=myhost,1433, and a named instance after a backslash, Server=myhost\SQLEXPRESS. In appsettings.json the backslash must be doubled: "Server=.\\SQLEXPRESS;...".
Where to keep it
Put it under ConnectionStrings in appsettings.json and read it with builder.Configuration.GetConnectionString("Default"). Keep passwords out of the file: user secrets in development, and an environment variable (ConnectionStrings__Default) or a secret store in production.
FAQ
What does TrustServerCertificate=True do?
It keeps encryption but skips validating the server certificate. Use it for local and Docker servers with self-signed certificates, not in production.
Trusted_Connection or Integrated Security?
Same thing: both mean Windows authentication. SqlClient writes Integrated Security.
How do I set the port?
After the server name with a comma: Server=myhost,1433. SqlClient has no Port keyword.
What is MultipleActiveResultSets?
MARS lets one connection run a new command while a data reader is still open. It is off by default; turn it on only if you need it.
Why "Keyword not supported"?
The keyword is not a SqlClient keyword, often one copied from another provider (Port, Host, Username). The page suggests the SqlClient name.
Other databases
- PostgreSQL connection string
- MySQL connection string
- SQLite connection string
- MongoDB connection string
- Redis connection string
- Connection string builder for every database