- It's a bad idea to modify a *.config file from inside the program.
- It's a bad idea for a webpage to modify any file in the root folder of your website.
- It's a bad idea to have permission set allowing a web page the modification of files in the root folder of your website.
Basically, you need to forget about the web.config, and structure your code to use a connection string the exist only in memory.