“Is it possible to get a raw PHP file off of a webserver (w/o FTP of course)?”
If the server somehow screws up such that instead of processing PHP files, it decides to show them as plain text, then you are in trouble. How likely is this? Not sure…
Why take a chance though if you know how to move your username/password into a file outside your www root?
Actually, you don’t need big G to expose the contents of your PHP file. If the server goofs up and the PHP server stops responding, you could get into a situation where the content of the PHP file is shown as plain text. Not very likely, but still a possibility.