I thought about this myself, I was worried someone could get passwords and things like that.
1) Use CHMOD 700 for all your files.
2) I use the include command and have the php files in another location (behind the www directory).
My actual file on the www directory looks something like:
<?
include "/php/mainpage.php";
?>
That's it. That's the code for index.php
the 'mainpage.php' file has all the real code and is WAY back in the server. This makes it difficult for a hacker to see it.
If your hosting a site and they won't let you do this, then create a directory and CHMOD is so NOONE but you can get in, then get the files from there as an include command.
