Any attacker accessing your server (via FTP, your web hosting control panel, or exploiting a vulnerability) can see your PHP code. Hackers can attack the PHP web applications by attacking the application itself or the database where sensitive information like user information/passwords is saved.