your choices are bad and worse.
typically your best bet is if no one else uses the server. in that case you can create a php file with the mysql username/password as variables, move it out of the apache root, and include the file at the start of any php file that needs to make mysql db calls.
but this means that anyone who can telnet to the machine can also read the include file with username & passwords. someone else on this board (can't remember the nick right now, you know who you are) had the suggestion that the host can run a seperate instance of apache for each user. when apache starts up it would read a protected file in the users home directory that only the user has access to and set the mysql username/password as apache environmental variables. but most isps aren't likely to do this as they're more concerned about profit then they are security with their el cheapo hosting accounts.
