"[hacker found my code] using Google code search. Now while this was interesting it still did not explain how the page was even indexed…. ohh wait I use Google Sitemaps and I had it on to index everything (the default setting) OUPS!!"
Interesting. Though google (or anyone) can't actually read the code of a php file if the server is setup properly to interpret those files as scripts, putting them in zip files kinda defeats that.
Oh well. I just started with PHP and SQL and even I have more sense than that.