I had been passing username/password strings directly into the ADO.NET connection string, however this means that if a user has a quote character in his password, it borks the ConnectionString and ...

And special characters? Frequently exclamation marks. CMU's password meter will offer advice for strengthening a password like "ILoveYou2!" -- which meets the standard requirements.

Burr recommended creating passwords that were essentially weird nonsense words, chock-full of special characters and occasional capital letters and numbers.