Write mysql credentials in plugin

As long as you aren’t passing out the plugin and other people don’t have access to it, you should be fine.

You might add something like the following to the top of the file just in case though:

defined('ABSPATH') or die('Access denied');

That will simply make sure that the file is loaded via wordpress (e.g. the wordpress ABSPATH constant has been defined)