php pages in private folder

[pesty]

Hello

My site was recently hacked with email header injection. I changed my script so it ignores bcc and cc requests.

My site is indexed so I use the robot meta tags on my php pages and set them as nofollow, no index. Since I am still pretty new to this, I was wondering if I should put the php pages in a private folder, and if I do, will I need to change the "action" in my <form> tag?

Thanks,

pesty