Connection String Placement in ASP.Net

Hi, if any upgrade time we need connection string expression to standard edition can u help me

public partial class Login : System.Web.UI.Page { SqlConnection cn = new SqlConnection("Data Source=LFI-IT-001;Initial Catalog=Payroll;User ID=sa;Password=test"); SqlCommand cmd; protected void btn_reset_Click(object sender, EventArgs e) { txt_uname.Text = " "; txt_pwd.Text = " "; } protected void btn_submit_Click(object sender, EventArgs e) { string var = Request.Params["var"]; if (var == null) { cn.Open(); cmd = null; cmd = new SqlCommand("select username,password from register where username='" + txt_uname.Text + "' and password= '" + txt_pwd.Text + "' ", cn); SqlDataReader dr = cmd.ExecuteReader(); if (dr.Read()) { string s = dr["username"].ToString(); Response.Write("Login Success"); Response.Redirect("Admin.aspx"); } else { Response.Write("<script>alert('Your not an authorised person')</script>"); cn.Close(); } } } }

public partial class Admin : System.Web.UI.Page { SqlConnection cn = new SqlConnection("Data Source=LFI-IT-001;Initial Catalog=Payroll;User ID=sa;Password=test"); protected void Button3_Click(object sender, EventArgs e) { GridView1.Visible = true; cn.Open(); SqlDataAdapter da = new SqlDataAdapter("Select * from Payroll where month='" + DropDownList1.SelectedItem.Value + "'", cn); DataSet ds = new DataSet(); da.Fill(ds, " "); GridView1.DataSource = ds.Tables[0].DefaultView; GridView1.DataBind(); cn.Close(); } }

What is the best way of password management please? I'd like it to be hidden from a Notepad's peek -- be it a user or an occasional developer. Or more prescisely, I don't want anybody to get access to my database by simply reading some strings in my constructed application. Please advise. Thanks. --Igor<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p>