title: Is server-side PHP code visible or accessible at client-side?
body: <ol>
  <li>Is it possible that a PHP script stored in a server, including public methods within the PHP script, be visible, accessible or modifiable from a client browser (including but not limited to console mode within a browser)? If yes, is a hacker able to inject any code or modify the PHP script?</li>
  <li>Is it possible for a hacker to pass an argument into a PHP class method (whether public/private/protected/no visibility specified) and get to see what code exists within the method, or to see what other codes exist within a PHP script?</li>
  <li>Is it best to store PHP file somewhere else rather than in /www or /htdocs directory?</li>
  </ol>
  
  <p>If any of the following above is true, what remedies can be done?</p>