saving stored procedure names and connection strings in config files.

Hi All,
I have heard that saving connection strings and stored procedure names in web.config file of our application is not safe. It is a good practice to store the connection string  in a config file rather than as a hard coded string in our code and if we need to change it,then it makes our job easier. Can you please tell me how to protect our code in web.config?


Thanks

...