[JaTochNietDan]

Well, yes it would require .amx access and a de-compiler (even at that I'm not sure it will be able to de-compile that information anyway), but the safest option is to have the MySQL user passworded and only allow local connections, therefore remote connections are not allowed to the MySQL server.

This combination will pretty much block any attempt at getting into the database, unless they manage to somehow get control of your server or get scripts onto your server.