If I publish a PHP page (e.g. mypage.php) on my hosted web space (the URL of the PHP page is publicly known, e.g. http://example.com/mypage.php), can a hacker access in some way the PHP source of this PHP page? If yes, how can I prevent this?
The page source can be either:
can a hacker access in some way the PHP source of this PHP page?
Yes.
If yes, how can I prevent this?
Well, that requires knowing about how they could access.
A hacker could get access to your server by SSH (in case of a virtual private server), or they could steal or brute-force your FTP(S) credentials if you're on a shared hosting plan. Then they would have access to the actual files on the server.
So, make sure to use secure passwords, and if it's your own server, maybe disable password-based login for SSH, install fail2ban, etc. You should also make sure that PHP scripts are owned by a user that cannot get administrative rights (i.e. can't sudo without password), and that several different sites hosted on one server have their script files be owned by different users, so in case one gets compromised, the others are still somewhat safe.
There are quite a few things to consider when setting up users and ownership on web servers. If you're new to administering servers, and you have one out in the public, running PHP scripts, be prepared to be very vulnerable. Keep backups and do your security updates, for both OS and third party PHP scripts.
Now, the most important thing is to make sure your web server is configured to handle PHP files with a PHP interpreter, and not serving them as plaintext files instead. But if you installed the web server and PHP according to the official documentation, and your PHP files are rendered fine, then you should not worry about this part.
Note that it does not matter whether PHP is mixed with HTML or not. The server will just output whatever the PHP file generates, and HTML is passed on as-is.
