>Because we need to supply connection string in order to connect to SQL Server, eg:
>lconn = SQLSTRINGCONNECT("DRIVER=MYSQL;SERVER=192.168.100.180;DATABASE=purchase;UID=uesrid;PWD=1234")
>So anyone can find out the login detail, including user id and passward.
>Does it have any better way to prevent unauthorized party to find the login detail?

Don't build the string with the password in the clear. Use variables and get the password from some encrypted source (dbf/ini/registry/whatever).

SQLSTRINGCONNECT("DRIVER=MYSQL;SERVER=192.168.100.180;DATABASE=purchase;UID=" + ;
lcUID + ";PWD=" + lcPwd)