About web configuration file.......

An alternative is to use Windows Authentication instead of a SQL login, so that your connection string looks like this:

Integrated Security=SSPI;database=your_database;server=your_server

You would need to establish logins in SQL Server for each Windows user or group that needs to access the database, but with this access method there's no need to put the login credentials in the connection string.