The SQL password is in a config file. Normally, when you surf to settings.php or whatever, you just see a blank page, or an error saying you aren't allowed to view the page directly, or something. When mod_php was disabled, httpd was just spitting out the PHP source.