I have recently heard that most of the PHP code is confidential
This appears to be incorrect. At the very lease, most PHP is unobfuscated and readable to anyone it's distributed to.
because if attackers know your database structure or the hash function used to encrypt the passwords, there is higher chances of a breach.
Also incorrect. Neither the database structure no hash function is critical in architecting the initial breach. Those might be useful after a breach, but what's important in generating the initial attack is knowledge of some flaw or vulnerability in the site code.
Having the source code can be helpful in finding security vulnerabilities (cf.: Wordpress and Joomla plugins), It's not really necessary. In fact, most of the interesting vulnerabilities (Windows, Flash, Internet Explorer, Acrobat, etc.) are found without the aid of source code.
Making your project Open Source makes the code easier for third parties to audit (with or without your permission) which should lead to earlier discovery of bugs and vulnerabilities, hopefully making them quicker and easier to patch.
Assuming your project is popular enough to get a reasonable amount of scrutany, this should mean that your project is less likely to have important security vulnerabilties once the initial discovery and vetting period is accomplished. It's difficult to get good data on this, but some evidence suggests that popular open-source software is less likely to have those "sleeper" vulnerabilities that sit there present and active but unpublicized for decades.