Comparison between the two printf statements

Question

please take a look at the two following c statements

printf("a very long string");
printf("%s","a very long string");

they produce the same result,but there is definitely some difference under the hood,so what is the difference and which one is better? Please share your ideas!

Answer 1

If you know what the string contents are, you should use the first form because it is more compact. If the string you want to print can come from the user or from any other source such that you do not know what the string contents are, you must use the second form; otherwise, your code will be wide open to format string injection attacks.