== How to fix it in MySQL Connector/Python

=== Code examples

The following code uses an empty password to connect to a MySQL database. 

The vulnerability can be fixed by using a strong password retrieved from an environment variable `DB_PASSWORD`. This environment variable is set during deployment. It should be strong and different for each database.

==== Noncompliant code example

[source,python,diff-id=101,diff-type=noncompliant]
----
from mysql.connector import connection

connection.MySQLConnection(host='localhost', user='sonarsource', password='')  # Noncompliant
----

==== Compliant solution

[source,python,diff-id=101,diff-type=compliant]
----
from mysql.connector import connection
import os

db_password = os.getenv('DB_PASSWORD')
connection.MySQLConnection(host='localhost', user='sonarsource', password=db_password)
----

=== Pitfalls

include::../../common/pitfalls/hard-coded.adoc[]

