The solution I used on our company's website is to have all the connection done with a module which is outside of the htdocs-tree and hence not easily reachable for web-users.

Of course (before anyone else says so) if the machine on which your web-server runs is compromised, all bets are off, but then I fear that it is already too late to do much.