== How to fix it in Core PHP

=== Code examples

The following code uses an empty password to connect to a MySQL database.

The vulnerability can be fixed by using a strong password retrieved from an environment variable `MYSQL_SECURE_PASSWORD`. This environment variable is set during deployment. It should be strong and different for each database.

==== Noncompliant code example

[source,php,diff-id=401,diff-type=noncompliant]
----
$conn = new mysqli($servername, $username, ""); // Noncompliant
----

==== Compliant solution

[source,php,diff-id=401,diff-type=compliant]
----
$password = getenv('MYSQL_SECURE_PASSWORD');
$conn = new mysqli($servername, $username, $password);
----

=== Pitfalls

include::../../common/pitfalls/hard-coded.adoc[]
