As far as I know there is now real convention about where things go, but there are a few rules that dictate where things aught to go. These are mainly for security reasons.
Like CGI binaries, they go in the CGI-BIN directory so that they can easily protected again acces from the outside and even from the inside, and the server can be instructed to treat files in that directory differently from the rest.
As for PHP files, they pretty much go wherever you think they should go (they are like normal pages after all), as long as you can make sense of it all.
Usually the libraries are in the lib dir, the include files go in the inc dir, etc.
One major exception are files that contain passwords and usernames, they should be placed outside the webserver documentroot.
