Overview
String formatting uses a process of string interpolation (variable substitution) to evaluate a string literal containing one or more placeholders, yielding a result in which the placeholders are replaced with their corresponding values.[1]
Discussion
Most current programming languages provide one or more string formatting functions that use a template string with placeholders and optional alignment, width, and precision indicators to generate formatted output.
| Language | Function | Examples |
|---|---|---|
| C++ | snprintf() |
snprintf(str, sizeof(str), "Hello %s!", name); |
| C# | Format() |
String.Format("Hello {0}!", name); |
| Java | format() |
String.format("Hello %s!", name); |
| JavaScript | template literal | `Hello ${name}`; |
| Python | interpolation (f-string) |
f"Hello {name}!" |
| Swift | interpolationString() |
"Hello \(name)!"String(format:"%.2f", value) |
String interpolation, like string concatenation, may lead to security problems. If user input data is improperly escaped or filtered, the system may be exposed to code injection.[2]
Key Terms
- code injection
- The exploitation of a computer bug that is caused by processing invalid data.[3]
- formatting
- Modifying the way the output is displayed.
- string interpolation
- Evaluating a string literal containing one or more placeholders, yielding a result in which the placeholders are replaced with their corresponding values.
