How can one ensure that the content of a PHP file, containing sensitive information like access credentials, is not visible in the page source when included in another file?

Sensitive information like access credentials should never be directly included in PHP files that are accessible via the web, as the content of these files can be viewed in the page source. To prevent this, store sensitive information in a separate configuration file outside of the web root directory and include it in your PHP files using the require or include functions. This way, the sensitive information is not visible in the page source.

// config.php (outside of web root directory)
<?php
$database_username = 'your_username';
$database_password = 'your_password';
?>

// index.php (inside web root directory)
<?php
require_once('/path/to/config.php');
// Use $database_username and $database_password here
?>