The "&" character breaks passwords that are stored in the web.config

I suspect that you didn't encode the password properly in the web.config file. Remember that web.config is a XML file, so entities must be encoded.

Instead of

my&password 

try

my&password

You can use sites such as FreeFormatter.com to escape/unescape XML strings.

You will need to put the encoded value in the web.config. It will read it out properly once you pull it but in the config file itself it needs to be encoded.

eg:

Password: your&password (what you expect)

Encoded version: your&password (what should be stored in your web.config)

Your wrapper method that reads out the value should unencode it automatically to your&password.

You will need to do this for all 'special' characters:

< = &lt;
> = &gt;
" = &quot;
' = &apos;
& = &amp;