This is one of the reasons why most developers do not store credentials in a PHP script file. DB credentials should not be part of your code, mainly for two reasons: they are different depending on the environment, and you don't want to expose them in the version control system. DB credentials and any other environment variables should be stored in a config file outside of your document root directory. They should be inaccessible from the internet.
The problem you describe is taking advantage of the remote file includes. When including remote files (the functionality is deprecated by the way), the PHP file will be executed by the remote server and the output will be included in your PHP script. So unless you have a script that generates a valid PHP file on your server, you don't have to worry that someone will be able to hijack it. As is said in PHP manual:
This is not strictly speaking the same thing as including the file and having it inherit the parent file's variable scope; the script is actually being run on the remote server and the result is then being included into the local script.
You would need to write code like this to be able to include it remotely:
<?php echo '<?php $thisVariableIsAvailableRemotely = 42;';
But files like "connect.php" should not be accessible from the internet as users have no use for executing them. Keep them out of your document root!
Additionally, you must ensure that your server is not accessible from outside the local network if you use localhost
or local network connection. If your website connects to a remote MySQL database then you should use strong password with SSL and keep the credentials very secure.
Lastly, I would like to add that having files like "connect.php" in your project is a code smell and a rather bad design. Please consider learning good design patterns such as MVC, front controller and dependency injection. Don't write spaghetti code that people wrote 20 years ago.
.php
was not currently failing on your server, they would only see any output your script generates. They would not have access to the values of any variables - same as I would not, if I just requested yourwww.anothersite.com/DB/connect.php
via my browser.