There shouldn't be a way to see the php source. One problem if you host with a company that has many sites on the same computer is that if you telnet in, you can see the files in other sites. So...anyone with a site could possibly get your password if you have it hardcoded in a php document. This can be a really big problem because most of the time the password for the MySQL database is the same as the account password.
