I just finished my first PHP site and now I have a security-related question. I used PEAR:DB for the database connection and made a separate parameter file for it. How should I hide this parameter file?

I found a guide (http://www.kitebird.com/articles/peardb.html) that says:

Another way to specify connection parameters is to put them in a separate file that you reference from your main script. ... It also enables you to move the parameter file outside of the web server's document tree, which prevents its contents from being displayed literally if the server becomes misconfigured and starts serving PHP scripts as plain text.

I have now put my file in a directory like this /include/db_parameters.inc

However, if I go to this URL, the web server shows me the contents of the file including my database username and password.

From what I've understood, I should protect this file so, that even though PHP would be served as text, nobody could read this.

What does outside of web server's document tree mean here? Put the PHP file out of public_html directory altogether deeper into the server file system? Some CHMOD?