During early 90s or so, gets()
was found to be flawed by design since it would keep reading data forever until it found the end of a string, which meant it could cause buffer overflows either accidentally or through security exploits.
Therefore gets
was flagged as an obsolescent function in the C99 standard. Meaning that from the year 1999, people were warned that it should not be used.
The function was removed entirely from the language in the C11 standard, meaning that there was a very generous transit period of no less than 12 years to fix legacy code. It was replaced by gets_s
, as a safe alternative to be used when porting old code to C11. It takes the buffer size as second parameter.
However, gets_s
should only be used for such C11 porting reasons, if at all. gets_s
is part of the optional bounds-checking interface in C11 and compilers need not implement it. The C11 standard recommends to use fgets
instead:
Recommended practice
The fgets function allows properly-written
programs to safely process input lines too long to store in the result
array. In general this requires that callers of fgets pay attention to
the presence or absence of a new-line character in the result array.
Consider using fgets (along with any needed processing based on
new-line characters) instead of gets_s.
Note that gets_s
has little to do with the non-standard Visual Studio compiler, even though that compiler happens to support this function, just as the standard conforming compilers that support the bounds-checking interface (__STDC_LIB_EXT1__
) do.