6
yeah, mainfile.php does need your database username/password. This isn't as big of a security risk as it would seem (especially if it's chmodded to 444). I always have the database user for a site seperate from all the others, with permissions ONLY for that sites tables. That minimizes the damage should something happen. There is a way too, although I do have to confess that I'm too lazy to do it, to move the database user/pass outside of the mainfile, which could help you rest easier. Better yet, there is also a way to have php encrypt your mainfile so that it's only readable by php (and would look like a bunch of garbage in a text editor, so you just save a copy locally for your own editing, then re-encrypt it when your done). Try searching for those if you are paranoid - or if you have important data to protect.
