I don't think that config file (or even script code) obfuscation is a sensible way of hardening a system. If the database access credentials are really the weak point of a system (I don't think so), the database authentication itself should be replaced by something more sophisticated, such as public/private keys, host based authentication, etc.