Some advice on using phpMyAdmin, if you can get the admin to only allow you and the "web user" access to it via file permissions. This prevents another user from being able to read the db password from the config files.
Also, when you're not using it, chmod the whole directory tree to 700. The prevents some random web user from accessing it when you're not using it.
And of course, don't use phpMyAdmin for the folder name......
If anyone knows any other good techniques to help safeguard this app, please let me know