in reply to Re^5: use of print f and sprint f
in thread use of print f and sprint f
We were talking about using:
printf("$l, $j, %.3f ...\n", $Hx, ...);
rather than
printf("%s, %s, %.3f ...\n", $l, $j, $Hx, ...);
and the question was whether the first one was unsafe.
My snippet demonstrated that escapes inside $l do get processed by printf (which to me is obvious) and therefore printf is subject to coersion by the user ("vulnerable") if the first method is used. It's not as vulnerable as C version, but it's still dangerous.
|
|---|