It would really depend on the security model of your Web and DB servers (that is, the software), as well as the degree of firewalling/access control/IDP you'd enforce on the two were they on separate servers.
All else being equal, it is probably the case that it's better to separate the two. Practically, however, at least in a LAMP environment, so long as you're using privsep Apache (if you aren't sure, don't worry, you are) and aren't using the root login to MySQL in your webapp, and you don't have tcp/3306 exposed to the outside world, you're not really gaining much security by moving one or the other onto a different piece of silicon. You do gain performance and debug-ability benefits, though.
Your question is in the style that appears to require an absolute answer, but without more information (at minimum, what OS and web/DB server flavors we're talking about), it's hard to even give an informative one.