It looks like they included something that when the PHP parser fails, it reveals the php code. Hence the connection protocols with username and password.

Try including the sensitive connection protocols from a non-www directory?