There are many things to be taken into account with securing a webserver, if there is any sensitive information on it you should have it secured whether or not you have it publicly accessible. Here is a guide for securing apache, it's not exhaustive but it's a good start: https://geekflare.com/apache-web-server-hardening-security/
When doing mysql calls in apache, you should always use PDO so there is a much smaller risk of sql injection, here is a basic guide for that: https://phpdelusions.net/pdo
You should also make sure your firewall on the pi does no allow any remote sql connections, here are some basic iptables rules to get you started.
This first one is probably the most important, without it most connections will quickly fail after being established.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
These next ones allow only traffic on specified ports, you should do this for every port you want to be connectable
This one will allow http traffic:
iptables -A INPUT --proto tcp --dport 80 -j ACCEPT
This one will allow https traffic:
iptables -A INPUT --proto tcp --dport 443 -j ACCEPT
This one will allow ssh traffic:
iptables -A INPUT --proto tcp --dport 22 -j ACCEPT
This one will block all traffic that is not explicitly allowed:
iptables -P INPUT DROP