== How to fix it in Django

=== Code examples

The following code uses an empty password to connect to a Postgres database. 

The vulnerability can be fixed by using a strong password retrieved from an environment variable `DB_PASSWORD`. This environment variable is set during deployment. It should be strong and different for each database.

==== Noncompliant code example

[source,python,diff-id=102,diff-type=noncompliant]
----
# settings.py

DATABASES = {
    'postgresql_db': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': 'quickdb',
        'USER': 'sonarsource',
        'PASSWORD': '', # Noncompliant
        'HOST': 'localhost',
        'PORT': '5432'
    }
}
----

==== Compliant solution

[source,python,diff-id=102,diff-type=compliant]
----
# settings.py
import os

DATABASES = {
    'postgresql_db': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': 'quickdb',
        'USER': 'sonarsource',
        'PASSWORD': os.getenv('DB_PASSWORD'),
        'HOST': 'localhost',
        'PORT': '5432'
    }
}
----

=== Pitfalls

include::../../common/pitfalls/hard-coded.adoc[]
