Guys, I am typically the one helping people who are new to PHP, but this is somewhat expert question, if someone could help me with.

I am writing a script for website that will take credit cards. I am trying to secure information as much as possible. My biggest issue is with MySQL db setup.

for example:
I have a db_setup.php file (hidden beyond root directory)

PHP Code:

//set parameters
 = 'db_user';
 = 'super-secret-password';
 = 'db-name';
//connect
 = mysql_connect('localhost', , );
//destroy trivial info
unset();
unset();
if (!) {
  die('Could not connect: ' . mysql_error());
}

 = mysql_select_db(, );
if (!) {
  die ('isses with DB : ' . mysql_error());
}
unset();
?> 

and this file is included in my index page

require('../protected/db_setup.php');

Where I point to the file outside of my site root for extra protection.

THE PROBLEM:

IF, and only IF php engine on the webserver chokes and decides to dump all php files in text form (instead of interpreting), whoever is accessing that site can read all my secrets in PLAIN TEXT!

How would you prevent that from happening?

I wonder if you're asking, but TrueStory how often does PHP engine crashes?

Well, a hacker can forcefully pass large information to server (in file upload form or in any user input form on the site)

I want to prevent my db_setup.php from being included (but still executed) at all! Even if php engine would never crash.

Gracias!