Question:

I'm pretty new to C. Writing in Visual Studio 2015, I'm trying to safely prompt a user for a string by using fgets. I want to use fgets to get the string, check if the string is too long, and reprompt the user if it is until they enter a good string. Here is my code

/* * Nick Gilbert * COS317 Lab 2 Task 2 */ #include "stdafx.h" int main() { char str[10]; int isValid = 0; while (isValid == 0) { printf("Please enter a password: "); fgets(str, 10, stdin); if (strlen(str) == 9 && str[8] != '\n') { //http://stackoverflow.com/questions/21691843/how-to-correctly-input-a-string-in-c printf("Error! String is too long\n\n"); memset(&str[0], 0, sizeof(str)); } else { printf(str); isValid = 1; } } printf("Press 'Enter' to continue..."); getchar(); }

However, when I run this and enter a bad string, the excess characters get fed into the next fgets automatically!

<a href="https://i.stack.imgur.com/FVfRU.png" rel="nofollow"><img alt="enter image description here" class="b-lazy" data-src="https://i.stack.imgur.com/FVfRU.png" data-original="https://i.stack.imgur.com/FVfRU.png" src="https://etrip.eimg.top/images/2019/05/07/timg.gif" /></a>

How can I fix this to do what I want it to do?

If the string read in by fgets doesn't end with a newline, call fgets in a loop until it does, then prompt the user again.

if (strlen(str) > 0 && str[strlen(str)-1] != '\n') { printf("Error! String is too long\n\n"); do { fgets(str, 10, stdin); } while (strlen(str) > 0 && str[strlen(str)-1] != '\n') { }

Also, never pass a variable at the first argument to printf, particularly if the contents of that variable comes from user entered data. Doing so can lead to a <a href="https://stackoverflow.com/questions/7459630/how-can-a-format-string-vulnerability-be-exploited" rel="nofollow">format string vulnerability</a>.

Try this:

#include "stdafx.h" int main() { char str[10]; int isValid = 0; while (isValid == 0) { printf("Please enter a password: "); fgets(str, str, stdin); if (strlen(str) == 9 && str[8] != '\n') { //http://stackoverflow.com/questions/21691843/how-to-correctly-input-a-string-in-c printf("Error! String is too long\n\n"); memset(str, 0, sizeof(str)); } else { printf("%s",str); isValid = 1; } } printf("Press 'Enter' to continue..."); getchar(); }

In addition:

While using memset() you can directly use the array_name rather &array_name[0].