Depending on what you are doing at the remote site, Expect may not be the best solution. Instead of using telnet/Expect, why not use ssh?

Rather than having to handle login character by character yourself, you simply invoke ssh using system(), specifying the account and machine names. Assuming you are connecting to the same machines all the time, you can set up configuration files so that the remote sites know which sites will connect to them. You have to follow some slightly complicated procedure, but the instructions are clear enough.

The result is a configuration where you do not have to specify a password, hence the password does not appear in any script nor in any config file. Since login is based on encryption keys, unauthorized sites are totally blocked. And your code becomes a lot simpler.

If you are connecting to different machines each time, then you will have to provide a password, somehow. But you still gain benefits, your connection will be encrypted, the password will be passed encrypted, not clear-text, to the remote machine.