Every production site needs to have credentials for the corresponding database they use. These files however shouldn't be served directly by the web-server.
This means, that for example a .php file shouldn't be just delivered as plain text BUT it should be interpreted. This you can set in your appache config for the corresponding server and you probably already did if you can see the results of
echo phpinfo(); when putting into a php file, and loading it in your browser.
That means, when you give these credentials into the php file, lets say like:
$db_user = <user>
$db_pass = <pass>
It won't be avaible for the "outside" world. However your application will be able to use these for joining to the appropiate database server.