Variable encoding


When using the “Configuration variables” to update the connectionstrings of my release it is encoding the “&” within the SQL users password.
variable:Password value:P&ssword
once the config file has update I get “P&ssword”.

Is this intended behaviour and if so is there a way to override it?


Thanks for reaching out. The Configuration Variable should apply the raw value of the variable into the config file. Could you send us the following info:

  • screenshots of how the variable looks like on your Project (same thing you sent already, but on a screenshot)

  • complete line of your config file after the update. You might wanna run a mock deployment here with fake data that also uses the “&” character

  • Version of Octopus you are running

I’ve set the conversation as private so only you and our staff can see its contents.



Thanks for getting back so quickly.

I’ve attached the requested info.

Cheers Dennis

OctopusVariableIssue.docx (323 KB)

Hi Dennis,

Good news it that works OK on my end as i expected. Let me show you my config:

  1. Connection string pre-deploy looks as shown on pre-web.config

  2. The variable config looks like variable.jpg

  3. The deployment step with the feature Variable substitution enabled looks as shown on DeployStep.jpg

  4. Connection String post-deploy looks like post-web.config

Please try to replicate that config and let me know how it goes



Pre-Web.config (4 KB)

Post-Web.config (4 KB)

Unfortunately I can’t use variable substitution at the moment as the development team set the connection string as a valid connection for their local machine. I use the Configuration variables option to replace the entire connection string.

As you could see from my variables I build the connection string from multiple variables as I need to have the password as sensitive. However even if I include the password in the connection string it still encodes it.

Can you re-do your testing to match how I’ve done it and see if your implementation encodes the variables.

Cheers Dennis

Hi Dennis,

Sorry for not testing it properly the previous time. The problem seems to happen when the variables are nested. I’ve created a github issue for this

Sorry for the inconvenience and thanks for being so diligent sending all the data to reproduce this.


Hi Dennis, this is by design - &'s are special characters in XML files which need to be escaped. If you type:

    <add name="DefaultConnection" connectionString="Database=Foo;Server=Bar;Password=P&ssword;"
      providerName="System.Data.SqlClient" />

Into a Visual Studio configuration file, VS will even show that the “&ssword” is invalid markup. Replacing it with &amp; is the correct behavior here if you want the password to work.

Hope this helps,


I’m getting a similar issues. I’m substituting a connection string in azure using the ‘configuration variables’ in octopus v3.1.1 for a web app. The azure connection string contains a “”" but octopus is converting this to “&quot;”

Hi Stephen,

Have you tried replacing the & alone with &amp; in the connection string as recommended by Paul?



Yes. That’s when I then get &amp;quot; output. The problem seems to be that octopus is html encoding the & into &

Hi Stephen,

Could you share us the config file via email so we can check this out? Please send it to .



i’ve just hit this issue with an Entity Framework connection string. There is no choice here because the EF connection string format uses " which gets rendered to the web.config as &quot;

Are there any solutions to this?

Ah my bad. I copied the web.config value so that the variable contained " instead of the literal "

Hi Rory,

I ended up refactoring the code to supply the connection string manually from another config setting. It would be great if it could be fixed in Octopus Deploy though.