I am developing a personal web-site with a lot of relatively sensitive (genealogical) information stored in a MySQL database. The site engine is written in PHP. So far (prototype phase) I have only one MySQL account and have hard-coded the database login and password in PHP and implemented user authentication independently from MySQL authentication. So as long as people access my web-site via my PHP engine, it is secure. However if someone manages to get the PHP code itself, they will get full access to the database.
Is it possible and is it a good practice to additionally secure the database by creating a separate MySQL account for each site user and use user password to access MySQL? If yes, then would it be possible to somehow securely store the database login/password between sessions (to enable "remember me" functionality)?
I don't have much experience in web development, this is my first project involving a self-programmed CMS.