You could also place the database outside the web root. As far as I know WordPress already supports putting `wp-config.php` one directory up from the main installation.