A better approach that avoids the overhead and complexity of mod_rewrite is to simply not put files you don't want reached by url in the root folder. You can just put them somewhere else and include them from there; simple and (more) secure, but for some reason this doesn't seem to be common knowledge.
An example structure might be
project/
project/root
project/lib
Your public code (e.g. index.php) would live in project/root, and that would be the website root. Your included code would live in project/lib can be easily included using require, include, etc.
No mod_rewrite. Very simple.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…