>Looks like it will only replace the userid and password if they are blank in the connection string to begin with, is that true?

It is...although you may have a user id and password in your connection string for developers, this information should be empty in a deployed application.

Regards,