Database connection string examples: start with the provider数据库连接字符串示例：先确认驱动与提供程序
A database connection string is a provider-specific representation of the endpoint, target database or service, identity method and connection behavior. The same database can use a URI, keyword-value string, JDBC URL, ODBC DSN-less string or framework object. Copy the example for the exact driver—not merely the same database brand—and replace only documented placeholders.数据库连接字符串是端点、目标数据库或服务、身份方式与连接行为的驱动专属表示。同一种数据库也可能使用 URI、键值字符串、JDBC URL、ODBC 无 DSN 字符串或框架对象。应复制与具体驱动完全匹配的示例，而不是只看数据库品牌，并且只替换文档说明的占位符。
The examples below deliberately omit passwords and private keys. Supply secrets through the approved secret mechanism for the runtime. Before production, verify parameter names, escaping, precedence, TLS identity checks, timeout units and whether the driver accepts credentials outside the string.以下示例刻意省略密码与私钥。应通过运行时获准的密钥机制提供秘密。用于生产前，必须确认参数名称、转义、优先级、TLS 身份校验、超时单位，以及驱动是否允许在字符串之外提供凭据。
Fields shared by most database connection string formats多数数据库连接字符串格式共有的字段
| Purpose用途 | Common names常见名称 | Validation question验证问题 |
|---|---|---|
| Endpoint端点 | host, server, data source | Does this name resolve inside the real runtime and match the TLS identity?该名称能否在真实运行时解析，并与 TLS 身份匹配？ |
| Listener监听器 | port, instance, service | Is the value configured, or merely a copied default?该值来自实际配置，还是仅复制了默认值？ |
| Target目标 | database, initial catalog, service name | Does the authenticated identity have permission to enter this target?认证身份是否有权进入该目标？ |
| Identity身份 | user, integrated security, authentication | Which identity does the deployed process actually present?部署进程实际提交的是哪个身份？ |
| Protection保护 | sslmode, encrypt, trust, certificate | Does the setting verify both the chain and server name?该设置是否同时验证证书链与服务器名称？ |
| Behavior行为 | timeout, pooling, application name | What units, defaults and precedence does this driver use?该驱动使用什么单位、默认值与优先级？ |
Similar-looking keywords are not automatically portable. For example, a provider may interpret “Server,” “Host” and “Data Source” differently, or may reject an option accepted by another driver. Always bind the example to a documented provider and version.外观相似的关键字并不一定可以互换。例如，不同提供程序可能以不同方式解释 Server、Host 与 Data Source，也可能拒绝其他驱动接受的选项。必须把示例与有文档支持的提供程序及版本绑定。
Database connection string examples by engine and driver按数据库与驱动分类的连接字符串示例
These sanitized examples show structure only. Replace the host, database or service and identity with approved values, then confirm every option in the exact provider documentation.以下脱敏示例只展示结构。请用获准值替换主机、数据库或服务及身份，并在具体提供程序文档中确认每个选项。
SQL Server ADO.NET with integrated identity使用集成身份的 SQL Server ADO.NET
Server=tcp:db.example.internal,1433;Database=appdb;Integrated Security=True;Encrypt=True;TrustServerCertificate=False;Integrated Security uses the process or delegated identity supported by the environment. Confirm certificate-name matching and do not switch TrustServerCertificate to True merely to suppress a trust error.Integrated Security 使用环境支持的进程身份或委派身份。应确认证书名称匹配，不要仅为消除信任错误就把 TrustServerCertificate 改为 True。
PostgreSQL libpq URIPostgreSQL libpq URI
postgresql://app_user@db.example.internal:5432/appdb?sslmode=verify-full&application_name=reportingSupply the password through an approved mechanism instead of the URI. URI-encode reserved characters and remember that libpq environment variables or service files can override or supplement values.应通过获准机制提供密码，而不是写入 URI。保留字符必须进行 URI 编码，同时注意 libpq 环境变量或 service 文件可能覆盖或补充参数。
MySQL Connector/J URLMySQL Connector/J URL
jdbc:mysql://db.example.internal:3306/appdb?sslMode=VERIFY_IDENTITY&connectTimeout=5000Connector/J option names and timeout units are driver-specific. Provide user and password through DataSource properties or an approved secret integration, and verify the CA material used by the JVM.Connector/J 选项名称与超时单位由驱动定义。应通过 DataSource 属性或获准密钥集成提供用户与密码，并验证 JVM 使用的 CA 材料。
Oracle JDBC Thin service-name URLOracle JDBC Thin 服务名 URL
jdbc:oracle:thin:@//db.example.internal:1521/app_serviceThe final component is a service name in this form, not automatically a SID. Confirm the listener advertises that service and use the approved wallet or TLS properties when required.此格式最后一部分是服务名，并不自动表示 SID。应确认监听器已公布该服务，并在需要时使用获准 wallet 或 TLS 属性。
ODBC DSN-less structureODBC 无 DSN 结构
Driver={APPROVED_DRIVER};Server=db.example.internal;Port=5432;Database=appdb;SSLMode=verify-full;Replace APPROVED_DRIVER with the exact registered driver name. Attribute names vary by driver, and the application architecture must match the installed ODBC driver.请把 APPROVED_DRIVER 替换为已注册驱动的准确名称。属性名称因驱动而异，而且应用架构必须与已安装 ODBC 驱动匹配。
Secure a connection string without breaking the application在不破坏应用的情况下保护连接字符串
Should a connection string contain a username and password?连接字符串应包含用户名和密码吗？
Avoid embedding reusable secrets where the driver and platform support runtime identity, token providers, integrated authentication or separately protected secret parameters. If a password-bearing connection string is unavoidable, treat the entire value as a secret: store it only in an approved secret system, restrict retrieval, redact it before logging, rotate it, and prevent copies in source control or deployment history.驱动与平台支持运行时身份、令牌提供方、集成认证或单独受保护秘密参数时，应避免嵌入可复用秘密。如果无法避免带密码连接字符串，则整个值都必须视为秘密：只存入获准秘密系统、限制读取、日志前脱敏、进行轮换，并防止进入源码或部署历史。
TrustServerCertificate and TLS verificationTrustServerCertificate 与 TLS 验证
Options that trust a server certificate without normal chain or hostname validation can be useful only in narrowly controlled scenarios and are not a general fix. They may hide an untrusted CA, wrong hostname, expired certificate or interception risk. Install the correct trust chain, use the intended DNS name, confirm driver TLS semantics, and validate certificate rotation before enforcing production settings.跳过正常证书链或主机名验证的选项只适用于极少数受控场景，不能作为通用修复；它可能掩盖 CA 不受信任、主机名错误、证书过期或拦截风险。应安装正确信任链，使用预期 DNS 名，确认驱动 TLS 语义，并在生产强制前验证证书轮换。
How to log connection configuration without leaking secrets如何记录连接配置而不泄露秘密？
Log a structured allowlist of non-secret effective settings: driver name and version, endpoint role, masked host if required, port, database, TLS mode, authentication method, timeout and pool policy. Do not log the original raw string. Redact before serialization and test with synthetic secret markers because exceptions, telemetry agents and support bundles can bypass application log formatting.记录非秘密有效设置的结构化白名单：驱动名称与版本、端点角色、必要时遮蔽的主机、端口、数据库、TLS 模式、认证方式、超时和连接池策略。不要记录原始字符串；应在序列化前脱敏，并使用合成秘密标记测试，因为异常、遥测 Agent 与支持包可能绕过应用日志格式。
Connection string timeout and pooling settings explained连接字符串超时与连接池设置详解
Connection timeout versus command timeout连接超时与命令超时有什么区别？
Connection timeout limits some portion of creating a session; command or query timeout limits an operation after a session exists. Drivers may also expose socket, DNS, TLS, login, pool-acquisition, idle, lifetime and validation timeouts. Document the exact property and measured stage. Increasing a command timeout will not repair a blocked TCP connection, and increasing a connect timeout can delay failover.连接超时限制创建会话的某一部分；命令或查询超时限制会话建立后的操作。驱动还可能提供 Socket、DNS、TLS、登录、连接池获取、空闲、生命周期与验证超时。应记录准确属性与实际阶段；增加命令超时无法修复被阻断 TCP，增加连接超时也可能延迟故障转移。
How pooling options change connection string identity连接池选项如何改变连接字符串身份？
Many pools key sessions by a normalized connection configuration and identity. Small differences in database, user, TLS, application name or option order can create separate pools, increase connection counts or preserve stale sessions. Use one canonical builder, control variations, set sensible maximums and lifetimes, and validate new sessions after rotation or failover instead of relying only on pool reuse.许多连接池按规范化连接配置与身份区分会话。数据库、用户、TLS、应用名或选项顺序的细微差异可能创建独立连接池、增加连接数或保留旧会话。应使用统一构建器、控制差异、设置合理上限与生命周期，并在轮换或故障转移后验证新会话，而不是只依赖连接池复用。
Validate a database connection string example before using it使用数据库连接字符串示例前进行验证
- Match the provider匹配提供程序 Confirm engine, driver package, driver version and accepted grammar. 确认数据库、驱动包、驱动版本与支持的语法。
- Replace placeholders safely安全替换占位符 Insert the approved endpoint and target; inject secrets separately. 填入获准端点与目标，并通过独立机制注入秘密。
- Inspect the effective configuration检查实际生效配置 Resolve environment variables, framework settings and secret references without logging values. 解析环境变量、框架设置与密钥引用，但不记录秘密值。
- Test through the real runtime通过真实运行时测试 Verify DNS, TCP, TLS, authentication, database selection and one read-only operation. 验证 DNS、TCP、TLS、认证、数据库选择与一次只读操作。
Never paste a production connection string into a public parser. Even when the password is removed, host names, account names, tenant IDs, certificate paths and topology can remain sensitive.绝不要把生产连接字符串粘贴到公共解析器。即使删除密码，主机名、账户名、租户 ID、证书路径与拓扑仍可能属于敏感信息。
Migrate a connection string across drivers or databases跨驱动或数据库迁移连接字符串
Map connection intent instead of copying option names映射连接意图，而不是复制选项名
Create a field-level migration matrix: endpoint and failover, database selection, authentication identity, secret delivery, TLS encryption and verification, connect budget, command budget, pooling, application name, encoding, session initialization and observability. For each intent, choose the supported destination property and test default behavior. A property with a similar name may have different semantics.建立字段级迁移矩阵：端点与故障转移、数据库选择、认证身份、秘密交付、TLS 加密与验证、连接预算、命令预算、连接池、应用名、编码、会话初始化与可观测性。为每个意图选择目标支持属性并测试默认行为；名称相似的属性可能具有不同语义。
Validate migrated connection strings with staged evidence如何分阶段验证迁移后的连接字符串？
Validate parsing, DNS, TCP, TLS, authentication, database selection, a minimal read, a controlled write when required, transaction behavior, timeout, failover and pool recovery. Test negative cases such as untrusted certificates and insufficient privileges. Record driver versions and effective non-secret configuration so a passing result can be reproduced after deployment.验证解析、DNS、TCP、TLS、认证、数据库选择、最小读取、必要时受控写入、事务行为、超时、故障转移和连接池恢复，并测试证书不受信任和权限不足等负向情况。记录驱动版本与有效非秘密配置，使部署后可复现通过结果。
A safe connection string validation workflow安全的连接字符串验证工作流
Use a sanitized copy and the exact target driver. Validate one responsibility at a time, and retain a non-secret parsed record rather than the raw value.使用脱敏副本与准确目标驱动，一次验证一种职责，并保留非秘密解析记录，而不是原始值。
- Identify the parser识别解析器Record driver, framework, version, connection format and configuration precedence.记录驱动、框架、版本、连接格式与配置优先级。
- Parse and redact解析并脱敏Use a builder or parser, reject unknown properties and remove passwords, tokens and private material before sharing.使用构建器或解析器，拒绝未知属性，并在分享前移除密码、令牌与私密材料。
- Verify endpoint intent验证端点意图Confirm environment, host, port or instance, database or service, reader/writer role and failover path.确认环境、主机、端口或实例、数据库或服务、读写角色与故障转移路径。
- Verify TLS and identity验证 TLS 与身份Confirm encryption, hostname and certificate verification, authentication method and runtime secret reference.确认加密、主机名与证书验证、认证方式和运行时秘密引用。
- Verify timeouts and pooling验证超时与连接池Measure the failing stage, pool key, maximums, lifetime, retry behavior and fresh-session result.测量失败阶段、连接池键、上限、生命周期、重试行为与新会话结果。
- Run representative operations执行代表性操作Validate selection, permissions, minimal queries, transaction behavior and failure handling from the real workload path.从真实工作负载路径验证选择、权限、最小查询、事务行为与失败处理。
Prepare a connection string for compatibility review为兼容性审查准备连接字符串
Prepare a parsed and sanitized list of driver and version, host, port or instance, database or service, TLS mode, authentication method, non-secret secret reference, connect timeout, pooling, application options, exact failure stage and environment. Never paste a password, token, private key or raw secret-bearing string.准备解析且脱敏的驱动与版本、主机、端口或实例、数据库或服务、TLS 模式、认证方式、非秘密秘密引用、连接超时、连接池、应用选项、准确失败阶段与环境。绝不要粘贴密码、令牌、私钥或带秘密原始字符串。
Review connection string compatibility before testing测试前审查连接字符串兼容性
Use the InfiniSynapse DB Compatibility Checker to organize endpoint, driver, TLS, authentication and option questions from sanitized data. Treat its output as guidance, then test the exact driver and workload with a fresh least-privilege connection.使用 InfiniSynapse DB Compatibility Checker，根据脱敏数据组织端点、驱动、TLS、认证与选项问题。工具输出应作为指导，随后使用准确驱动与真实工作负载进行新的最小权限连接测试。
Open DB Compatibility Checker打开 DB Compatibility CheckerDatabase Connection String Examples and Formats FAQ数据库连接字符串示例常见问题
What is a database connection string example?什么是数据库连接字符串示例？
It is a sanitized provider-specific pattern showing where endpoint, port, database or service, identity method, TLS and behavior options belong. It is not ready for production until each placeholder and parameter is validated for the exact driver.它是经过脱敏的驱动专属模式，用于展示端点、端口、数据库或服务、身份方式、TLS 与行为选项的位置。在为具体驱动验证每个占位符和参数之前，不能直接用于生产。
Are database connection strings the same across SQL Server, PostgreSQL, MySQL and Oracle?SQL Server、PostgreSQL、MySQL 与 Oracle 的连接字符串相同吗？
No. Engines and drivers use different URI schemes, keyword names, separators, escaping rules, TLS settings and target identifiers. Even two drivers for the same database can accept different options.不同。各数据库与驱动使用不同 URI scheme、关键字、分隔符、转义规则、TLS 设置和目标标识；同一数据库的两个驱动也可能接受不同选项。
Should a connection string example include a password?连接字符串示例应该包含密码吗？
No real password should appear in documentation, code, tickets or public tools. Prefer a secret store, managed identity, integrated authentication or provider-supported credential callback. If a placeholder is shown, it must be unmistakably nonfunctional.文档、代码、工单或公共工具中都不应出现真实密码。应优先使用密钥库、托管身份、集成认证或驱动支持的凭据回调。若展示占位符，必须明确不可用。
What does sslmode=verify-full or certificate verification do?sslmode=verify-full 或证书验证有什么作用？
Provider terminology differs, but a strong verification mode should validate the certificate chain and confirm that the server name used by the client matches the certificate identity. Encryption without identity verification does not provide the same protection.不同驱动术语有所差异，但强验证模式应校验证书链，并确认客户端使用的服务器名称与证书身份匹配。只有加密而没有身份验证，不能提供同等级保护。
Why does a copied database connection string example fail?为什么复制的数据库连接字符串示例会失败？
The example may target another driver version, grammar, endpoint type, authentication method or timeout unit. Placeholders may be escaped incorrectly, and environment or framework settings may override values. Compare the exact provider documentation and effective runtime configuration.示例可能对应其他驱动版本、语法、端点类型、认证方式或超时单位；占位符也可能转义错误，环境或框架设置还可能覆盖参数。应对照具体提供程序文档与实际运行时配置。
How do I test a database connection string safely?如何安全测试数据库连接字符串？
Use sanitized structure review first, inject secrets through the approved runtime mechanism, then test from the real application environment. Verify TLS identity, authentication, target database and a minimal read-only operation without logging the complete string.先审查脱敏结构，通过运行时获准机制注入秘密，再从真实应用环境测试。验证 TLS 身份、认证、目标数据库和最小只读操作，同时不要记录完整字符串。