sprintf vs strcpy

Blake Miller

So I see a lot of code like this lately: sprintf(pUserPwd, "%s", oVerifedWriteDlg.m_UserPwd); Why use that instead of just going with strcpy? strcpy(pUserPwd, oVerifedWriteDlg.m_UserPwd); Am I missing something? I am inclined to think the sprintf would be a lot slower ... :doh:

David Crow

My personal preference would me to use strcpy(), unless I was constantly changing what I wanted in pUserPwd (e.g., padding, numbers, justification, additional variables).

"Approved Workmen Are Not Ashamed" - 2 Timothy 2:15

"Judge not by the eye but by the heart." - Native American Proverb

Zac Howland

Laziness is the main culprit there. The sprintf version is far more likely to introduce buffer overrun bugs (e.g. if the wrong delimeter is used). Note that the safer operations are actually to use the std::string class, or at the very least, the strncpy function (or its variants).

If you decide to become a software engineer, you are signing up to have a 1/2" piece of silicon tell you exactly how stupid you really are for 8 hours a day, 5 days a week Zac

led mike

If you are writing for Windows only (not cross-platform) you should use the safe string routines strcpy == StringCchCopy[^]

led mike

Zac Howland

led mike wrote:

If you are writing for Windows only (not cross-platform) you should use the safe string routines strcpy == StringCchCopy[^]

Or the slightly more familiar (syntax-wise) replacements: strXXX_s

If you decide to become a software engineer, you are signing up to have a 1/2" piece of silicon tell you exactly how stupid you really are for 8 hours a day, 5 days a week Zac

led mike

yes they are also safe versions but are not all the same as the strsafe library routines

You should be aware that strsafe functions, such as StringCchCopy and StringCchCat behave
differently than strncpy_s and strncat_s. If strncat_s detects an error, the function will
set the string to NULL. However, by default, strsafe will fill the destination with as much
data as possible, and then NULL-terminate the string. You can mimic the same behavior in
strsafe with code like this:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure03102004.asp[^]

led mike

Stephen Hewitt

I'd side step the whole issue and use a string class such as std::string or CString.

Steve