# V618\. Dangerous call of 'Foo' function\. The passed line may contain format specification\. Example of safe code: printf\("%s", str\);

The analyzer has detected that a formatted output function call might cause an incorrect result\. Moreover, such a code can be used for an attack \(see this article for details\)\. 

The string is output directly without using the "%s" specifier\. As a result, if there is a command character added into the string accidentally or deliberately, it will cause a program failure\. Consider a simplest example:

```cpp
char *p;
...
printf(p);
```

The call of the printf\(p\) function is incorrect, as there is no format string of the "%s" kind\. If there are format specifications to be found in the 'p' string, this output will be most likely incorrect\. The following code is safe:

```cpp
char *p;
...
printf ("%s", p);
```

The V618 warning might seem insignificant\. But actually this is a very important thing when creating quality and safe programs\.

Keep in mind that you may come across format specifications \(%i, %p and so on\) in a string quite unexpectedly\. It may occur accidentally when user inputs incorrect data\. It may also occur deliberately when incorrect data are input consciously\. Absence of the "%s" specifier may cause program crash or output of private data somewhere outside the program\. Before you turn off the V618 diagnostic, we insist that you read the article "[Wade not in unknown waters\. Part two](https://pvs-studio.com/en/blog/posts/cpp/0129/)"\. Corrections to the code you'll have to make will be too few to ignore this type of defects\.

Note\. The analyzer tries not to generate the V618 warning when a function call cannot have any bad consequences\. Here is an example when the analyzer won't show you the warning:

```cpp
printf("Hello!");
```