If someone knows my DB username and password what can they do? Can they connect to my db and do stuff?
If the server allows remote connections, or the person has access to the server, in which case you'd have a lot more the worry about.
remote connections what is that?
The ability to access the server from the outside, e.g. connecting via a public IP address.
Thanks very much I love you man!