connectionString and securing passwords

Is there anyway to create a valid connectionString without having a plain-text password in a file on the server? I can't use Windows authentication, because it is an Internet (as opposed to Intranet) application. So as far as I can tell, my connectionString must contain  "UserName=*;Password=*;" elements. This needs to be either hard coded into an ASPX web page, or stored in the web.Config file. If someone hacks their way into accessing these files, then they have the password to the Database, as well. Is there anyway to avoid this?

Yes. You can encrypt the password in your web.config file.

Check the following articles:

• http://www.4guysfromrolla.com/articles/021506-1.aspx
• http://msdn.microsoft.com/en-us/library/Aa302403
• http://weblogs.asp.net/scottgu/archive/2006/01/09/434893.aspx

Hope this helps,
Hajan

http://msdn.microsoft.com/en-us/library/Aa302403