Best Approach To Login To SQL Server Express?

I borrowed some code from a colleague to login into SQL Server:

public static SqlConnection GetConnection()
{
string dbNameSvr = ConfigurationSettings.AppSettings.Get("DataBaseServer");
string db = ConfigurationSettings.AppSettings.Get("DataBase");
string userId = ConfigurationSettings.AppSettings.Get("UserId");
string password = ConfigurationSettings.AppSettings.Get("Password");

string connStr = "Data Source=" + dbNameSvr + ";" +
"Database=" + db + ";" +
"User Id=" + userId +";" +
"Password=" + password + ";";

SqlConnection aConn = new SqlConnection(connStr);

return aConn;
}



It works but someone has commented that it is very insecure. I don't really understand why but I'll take his word for it. So I'm wondering what approach most people use to have a web app login to their database?

Robert W.