I am attempting to protect a flatfile database from being accessed or queried by anyone except PHP running from my server.
Google has a lot of very broad theory but nothing solid in terms of processes on a webserver to secure the data. It cannot be contained above the web root.
You can use .htaccess: