An example to demonstrate why you should never store passwords in web-accessible PHP files.

config.php

# Located one level below the DocumentRoot
<?php $secure_password = "i_am_so_smrt"; ?>

index.php

# Located just inside the DocumentRoot
<p>
  Bad idea:
  <?php $insecure_password = "steal_my_stuff"; ?>
  <?php echo $insecure_password; ?>
</p>

<p>
  Good idea:
  <?php include '../config.php'; ?>
  <?php echo $secure_password; ?>
</p>