All You Should Know About gets() and puts() in C

Learn how to use the gets() and puts() functions in C to read and write strings.

In C programming, gets() and puts() are two common input/output functions.

In this article, we will discuss these two functions apply to I/O in C, along with examples. 

C gets() Function

In C language, the gets() function reads a line of characters from standard input (keyboard). It stores it as a string in the array that points to its argument. The function reads until a newline character (\n) or an end-of-file (EOF) reaches. It then replaces the newline character with a null terminator (\0) and returns the input string.

The declaration of gets() function is in the stdio.h header file in C language.

The syntax of gets() function declaration is:

where str is the pointer to the character array where the input string is stored. The function returns a pointer to the same character array.

Here is an example of using gets() to read a line of characters from standard input:

Output:

Enter a string: Welcome!

You entered: Welcome!

In the above example, the gets() function reads a line of characters from standard input and stores it as a string in the str array. The program then prints the input string using printf().

Why Use fgets() instead of gets()

The gets() function is unsafe to use due to its vulnerability to buffer overflow attacks. Therefore, use alternative functions such as fgets(). Now, you must be wondering what are buffer overflow attacks?

Buffer Overflow 

In simple terms, buffer overflow is a type of security vulnerability that can occur in programming languages like C. It happens when more data is written to a buffer (temporary storage area in memory) than it can hold.

For instance, let’s say we have an integer variable called x that can store a maximum value of 10. If we try to store a value greater than 10 in x, it will overflow and overwrite the adjacent memory locations. This can lead to unexpected behavior or even security vulnerabilities, as the program may execute unintended instructions or overwrite sensitive data.

Now, let’s consider an example of buffer overflow attack in C. Suppose we have a C program that reads a user input string using the gets() function, which does not check the length of the input string. If the user inputs a string that is larger than the allocated memory size of the input buffer, the excess data will overwrite the adjacent memory locations, potentially overwriting important data, such as function pointers or return addresses. An attacker can exploit this vulnerability by crafting a malicious input string that overwrites the return address of a function, causing the program to execute the attacker’s code instead of the intended code.

This type of attack is a buffer overflow attack, and it can execute arbitrary code, steal sensitive data, or even crash the program. Therefore, it is essential to ensure that input data is properly validated and sanitized to prevent buffer overflow vulnerabilities.

The fgets() Function in C

The fgets() is a function in the C standard library that reads a line of characters from a file stream, such as standard input (stdin), and stores it as a string in a character array.

The syntax of fgets() function is:

where str is the pointer to the character array where the input string is stored, n is the maximum number of characters to be read (including the null terminator), and stream is the pointer to the file stream to be read from (stdin in most cases).

The function reads up to n-1 characters from the file stream or until a newline character (\n) or end-of-file (EOF) is reached, whichever comes first. It then replaces the newline character with a null terminator (\0) and returns the input string. If an error occurs during reading, fgets() returns NULL.
Here is an example of using fgets() function to read a line of characters from standard input:

In the above example, fgets() reads up to MAX_SIZE – 1 characters from standard input and stores them as a string in the str array, ensuring that the input string does not exceed the allocated memory size. The program then prints the input string using printf().

Note that fgets() function also reads the newline character (\n) if it is present in the input string, which you can remove by replacing it with a null terminator.

C puts() Function

The puts() function in the C standard library writes a string to standard output (stdout) followed by a newline character (\n).

The syntax of puts() function is:

where str is the pointer to the null-terminated string to be written to the standard output.

The function returns a non-negative integer value if successful, and -1 if an error occurs.

Here is an example of using puts() function to write a string to standard output:

In the above example, the puts() function writes the string “Hello, World!” to the standard output, followed by a newline character (\n), resulting in the following output:

Hello, World!

Note that the puts() function automatically appends a newline character (\n) to the end of the output string. It ensures that the next output writes on new line. If you don’t want to add the newline character, you can use the printf() function instead.

If you are on the path to becoming the next big programmer, check out the best certifications from C programming courses!