I think I understand now, sorry for the mix up. I've hard-coded auth info before also, but that wan't very nice as you've found. I made a quick module at one time so at least my connections only went through one place for the password so I didn't have to have 10 scripts all with the info and it was only stored in one place, but you still have the password in a file, so you almost might as well not protect the Db, less relying on read priveleges.