system("PAUSE") security hole?

[Jao]

Hi,
Earlier I was browsing the web for a way to PAUSE my console screen.I already knew of the system("PAUSE") method but thought I was doing it wrong since my IDE didn't recognize it. While I was searching I came across a similar issue. People were posting what I already knew, but there was one poster named Duoas that said it was a security risk. Duoas if you read this can you please inform me why it is a security risk?

[edit] the aforementioned thread was from 2008 mind you and after looking through it and others could not find a reason why it was a security risk

[Jao]

Ok I get it now. I'm fairly new to coding (hence why I'm in the begginers forum) so I'm trying to find the most efficient way to learn and gain "muscle memory" for the future.

[coder777]

Well, what you actually do is calling a program "PAUSE". In most cases it does what you want, but it is not guaranteed. On other systems it might be replaced with other maybe fraudulent functionality started by your program. Or does not exist at all.

See:
http://www.gidnetwork.com/b-61.html

[Handy Andy]

jao,

since my IDE didn't recognize it.
Could be because of not including the header file like Windows.h or stdlib.h. Not sure right now which one defines the system commands, but Windows.h works for me.

I found a couple of links that might help you:
http://stackoverflow.com/questions/1107705/systempause-why-is-it-wrong
http://stackoverflow.com/questions/9386651/pause-screen-at-program-completion-in-c
or as I did search c++ system pause.

If you want a simple way to pause the screen I use this

cout << "\n\n\n\nFin Press any key to continue -- > ";
_getch();
 

not fancy, but it works for now. The _getch() just waits for a key press, you do not have to hunt for the enter key.

Hope that helps,

Andy

[E0p9LyTq]

@Handy Andy,

_getch() is not a C/C++ standard library function, even though many compiler implementations do include a version of it. Better to use the C++ I/O stream methods already part of the standard.

http://www.cplusplus.com/forum/beginner/1988/#msg7263

[Handy Andy]

@FurryGuy,

Thank you for the input, I still have a lot to learn about the standard libraries and what is good practice. For now it is an alternative to system("Pause"). Normally I just comment out those two lines when I am finished because it was used for debugging.

As the thread describes in your link there is a line of code i have had a problem with std::cin.ignore( std::numeric_limits<std::streamsize>::max(), '\n' );. Everything appears to work until I get to max() and then I get an error even though I have included limits unless there is another header file I have missed. Just someethng I have been working on for awhile.


Andy

[E0p9LyTq]

A less than optimal alternative, yes, but still not recommended.

Easier to not learn bad coding habits from the start.

[Z e r e o]

Here is an article from Duoas that does a good job explaining what is wrong with system("PAUSE"), etc. http://www.cplusplus.com/articles/j3wTURfi/