Comparison between the two printf statements

please take a look at the two following c statements

printf("a very long string");
printf("%s","a very long string");

they produce the same result,but there is definitely some differen开发者_运维技巧ce under the hood,so what is the difference and which one is better? Please share your ideas!

If you know what the string contents are, you should use the first form because it is more compact. If the string you want to print can come from the user or from any other source such that you do not know what the string contents are, you must use the second form; otherwise, your code will be wide open to format string injection attacks.

The first printf works like this

'a' is not a special character: print it
' ' is not a special character: print it
'v' is not a special character: print it
...
'g' is not a special character: print it

The second printf works like this

'%' is a special character:
    's' print the contents of the string pointed to by the 2nd parameter

The first one passes one parameter and the second passes 2, so the call is slightly faster in the first one.

But in the first one, printf() has to scan the long string for format specifications and in the second one, the format string is very short, so the actual processing is probably faster in the second one.

More important (to me anyway), is that "a very long string" is not likely to be a a constant string as it is in this example. If you're printf'ing a long string, you're probably using a pointer to to something that the program generated. In that case, it's a MUCH better idea to use the second form because otherwise somewhere, somehow, sometime, the long string will contain a format printf format specification and that will cause printf to go looking for another argument and your program will crash. This exact problem just happened to me about a week ago in code that we have been using for nearly 20 years.

The bottom line is that your printf format specification should always be a constant string. If you need to output a variable, use printf("%s",var) or better yet, fputs(var, stdout).

The first is no less efficient than the second. Since there are no format sequences and no corresponding arguments, no work must be done by the printf() function. In the second case, if the compiler isn't smart enough to catch this, you will be calling for unnecessary work (note: miniscule compared to actually sending (and reading!) the output at the terminal.

printf was designed for printing with formatting. It is more useful to provide formatting arguments for the sake of debugging although they aren't required.

%s takes a value of a const char* whereas leaving no argument just prints the literal expression.

You could still cast a different pointer to the const char* explicitly and change its contents without changing the output expression.

First of all you should define "better" better since it is not smart enough by itself. Better in what way? performance, maintenance, readibility, extensibilty ...

With the one line of code presented I would choose option 1 for almost all versions of 'better'

• It's more readible
• It does what it should do and nothing more (KISS principle)
• It's faster (no pointless moving memory around to stuff one string into another). But unless you are doing this printf a hell of a lot of times in a loop this is not that a big plus.