You can't really hide JavaScript code from the viewers of your site. The code is executed by the web browser, so it has to be downloaded to their machine. Even if you could keep them from viewing the .js file on the server, they could always pull it out of the browser cache and look at it. The best place to put JS include files in either in your public_html or a subdirectoy of public_html.
PHP include files should definitely be kept in a directoy that is not publicly viewable; i.e., outside of public_html. Since PHP runs on the server, and can access files on the server, allowing people to view your PHP code can pose a security risk.
You could create a directory for your PHP include files at the same level as public_html. For example, /home/user_name/php. Then put a line like this in your .htaccess file:
>php_value include_path .:/home/user_name/php
This adds the directory to PHP's include path, so you don't have to reference the file by it's absolute path. Take a look at the PHP Manual for more information.
HTH
Rob