There are some caveats with this, first one would hope that the path: /home/ilia/sql.cnf is not located within the webroot of your website, or an attacker could simply visit the url http://ilia.ws/sql.cnf to view your database credentials.
Additionally one would hope that your website did not include various information disclosure bugs or a phpinfo page as phpinfo will dump the $_SERVER array and thus disclose your database credentials to any visitor of this page.
Further more the assumption that it would be harder for an attacker to obtain the information if it's stored in a PHP file versus environment variables is rubbish. Your example sets the environment variables for every page request. That means that a directory traversal attack which may not have permissions to read your sql.conf file will still probably have permission to read /prof/self/environ and obtain the credentials that way.
I would ensure that your database server is bound to the loopback interface, that your database credentials have the lowest possible privileges and that your web application and server software are patched in a timely manner and just store the credentials in the php file.