Looking at some old classic ASP sites which could do with a bit of tightening up. The SQL server database connection string has the password in clear text within an include file on the server. Obviously this is nasty as anyone with access to the server or the source code can gain immediate access to the database (if they have firewall access etc).
I'm assuming that there is a recommendation on how to do this more securely (even a DSN would be better I guess?)
Any suggestions welcomed - hopefully not a load of "what year are we living in comments" ;-)