I'm trying to make a connection to an SQL server in php. Is it safe to just put the database credentials in plaintext in the .php file? Can a user edit the php code in a a .php page and change the way an input is handled?
No, if you are talking about end user I don't think he/she can edit your php files because server didn't render php in plain text until it is being told to do so. what you can do to secure your connection.php files is to store it in a separate directory and restrict direct access to the file and directory by server config or whatever means.
If you don't want to keep database credentials in plaintext in PHP files, you could store them in environment variables on Operative System and get them using the PHP function called
getenv; something like this:
<?php $user = getenv('DB_USER'); $pass = getenv('DB_PASS'); ... ?>
You can add another security level in this way, the credentials will not be in plaintext on source code and Operative System hardening will help to secure them too.
I hope this information helps you.