== How to fix it in Java SE

=== Code examples

The following code uses an empty password to connect to a Postgres database. 

The vulnerability can be fixed by using a strong password retrieved from Properties. This `database.password` property is set during deployment. Its value should be strong and different for each database.

==== Noncompliant code example

[source,java,diff-id=201,diff-type=noncompliant]
----
Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "login", ""); // Noncompliant
----

==== Compliant solution

[source,java,diff-id=201,diff-type=compliant]
----
String password = System.getProperty("database.password");
Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "login", password);
----

=== Pitfalls

include::../../common/pitfalls/hard-coded.adoc[]
