Is this an internet website or a intranet site? If the servers are open to "man in the middle attack " between IIS and sql server there are major security issues.

The web.config is a good place for the db conn string, why hard code it any where else - it has to be somewhere the site code has access to.