> This is particularly true if the file is named something like dbconnect.inc, as most browsers will
> simply display the contents as plaintext
This is because most webservers aren't set up to process files with the .inc extension as any particular filetype and default to plaintext (this is true of both Apache and IIS). The way to keep this from happening is to use the .php extension for your include files or to configure the server so that .inc files are processed as PHP. Even so, the *best* thing to do is to keep sensitive data outside the web root altogether.
(BTW, there's nothing magical about '.inc' -- PHP itself doesn't care what file extension you use for include files; it reads the file, includes it into the script, and only then tries to process the whole thing as PHP code. You can put PHP code into a file named 'myinclude.jpg', then include this file in one with a .php extension, and the code will be executed.)
Jon Stephens
MySQL Documentation Team @ Oracle
MySQL Dev Zone
MySQL Server Documentation
Oracle