Q:

What is the best place to inject the db password to the default EF connection string

The Entity data Model wizard says :
This connection string appears to contain sensitive data (for example, a password) that is required to connect to the database. Storing sensitive data in the connection string can be a security risk. Do you want to include this sensitive data in the connection string?
I have selected No, and I found the following generated new connection string in my Web.config:
 <add name="eMarket_DBEntities" connectionString="metadata=res://*/App_Code.EFModel.csdl|res://*/App_Code.EFModel.ssdl|res://*/App_Code.EFModel.msl;provider=System.Data.SqlClient;provider connection string=&quot;data source=.\sqlexpress;initial catalog=eMarket_DB;user id=sa;multipleactiveresultsets=True;application name=EntityFramework&quot;" providerName="System.Data.EntityClient;" />

Also in Web.config:
  <entityFramework>
<defaultConnectionFactory type="System.Data.Entity.Infrastructure.SqlConnectionFactory, EntityFramework" />

How and where is the best place to pass the password in one time to be default for EF?

A:

There are two ways to not include password in Web.Config.

Put password in IIS's host settings. IIS keeps one more host config per host, and all settings in this host config is applied before web.config. The only problem is, only administrator can modify it through IIS Management Console.
Password Less connection string will use Application Pool Identity user to Login. You can create a windows user and set it as Application Pool Identity. And give read access to your site content folder as well. And add this User in SQL database and make this user db-owner. This is most safe way to host sites as each Application Pool runs in Isolation & more rights can be given per app. The only problem is, Task manager no longer display site name for worker process.

In Shared Hosting, anyone with access of control panel probably has access to everything, there is little you can do to secure it, but this is how we do it.

We create separate FTP login for developers to upload code.
Administrator sets up the config file and developers do not upload web.config ever. By mistake if they upload, admin will login to some console or ftp and modify web.config
Developers should not be given admin access to shared hosting control panel. Setting up website along with uploading of code and editing web.config must be done by the admin.
Windows Azure web sites does let you modify web.config in admin control panel.

