Rules / PHP
SHIELD-PHP-014
Hardcoded credentials in source
What it detects
A password or secret is assigned or defined as a literal string constant in code.
How to fix
Load credentials from environment variables or a secrets manager, not from source.
Vulnerable — Shield flags thisdb.php
<?php
// db.php — database connection settings
$db_host = "localhost";
$db_user = "app";
$db_pass = "changeme-EXAMPLE-only";
$link = mysqli_connect($db_host, $db_user, $db_pass, "appdb");
Fixed — scans cleandb.php
<?php
// db.php — database connection settings
$db_host = getenv('DB_HOST') ?: 'localhost';
$db_user = getenv('DB_USER');
$db_pass = getenv('DB_PASSWORD');
$link = mysqli_connect($db_host, $db_user, $db_pass, "appdb");
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-014, the fixed one does not.