You used sprintf over strcat_s, which would make it less safe.
But why are we bothering with C API in the first place? This is C++. If we want to use sprintf, we can use Boost.Format. Or we can use std::string.