Yes. I mean, even 6 year old PHP articles get this right, don't serve files from the same place your executing code is running from.

public_html has specific connotations for a reason.