That was something I noticed as well. I usually store my username and password in a .conf file in a another directory and then grab it with some form of Config::Simple. Here's an example I use with CGI::Application::Plugin::Config::Simple (thanks to gmax):

sub dbconnect { 
   my $self      = shift;
   my %attr      = @_;

   my $user = $self->config_param($attr{'db'}.'.user');
   my $pass = $self->config_param($attr{'db'}.'.pass');

   my $dbh = DBI->connect_cached('DBI:mysql:'.$dbn.':'.$host,
                                  $user,
                                  $pass, 
                                  {RaiseError => 1}
                                  ) or die "Can't connect: $DBI::errst
+r\n";
   return ($dbh);
}
[download]