Question

I am writing a code like this using snprintf():

char myId[10] = "id123";

char duplicateId[10] = "";

snprintf(duplicateId, 10, myId);

As you can see, I am not specifying the format specifier %s explicitly.

Do I need to explicitly specify the format specifier in the above snprintf() statement like this snprintf(duplicateId, 10, "%s", myId);?

Answer 1

No, you don’t have to, technically. But it’s better practice to do so, because without a constant format string, your format string remains modifiable thus your code will be more prone to format string attacks.

Ah, and also use sizeof(duplicateId) instead of a constant 10 – also for security reasons (in order to avoid future buffer overflows when changing the size of the output buffer of sprintf).