Using .htaccess does not necessarily mean a password file. Check out mod_authmysql for making Apache get the passwords from MySQL.