Input a password and replace with *s

Hi. I was wondering if there was a way to replace characters input by fgets() with * since a password is being input. I can't think of any way to do it while inputting the password. I don't think fgets() can do it but again I can't think of any other function that can.
getchar() would not work for me, since I don't know how many characters will be input (even though there is a maximum ofcourse).

I know I can print '\r' after I input it and output something like "Password succesfully input" but I hoped there would be a way to do it while inputting the password.

Thank you.

I guess you could use getchar() in a while loop. Something like:

Code:

---

while((string[i]=getchar()) != '\n')
{
    i++;
    putchar('*');
}

---

I havent tried it so i'm not sure how well, or if, it will work.

Except that you have to push enter after entering a character :(

Use a library like curses or pd curses (for Windows/Unix)

This is non-trivial to do in standard C, since the way you "turn off echo" [echo here means "show what's being typed"] is system dependant.

There are two choices:
- a cross-system library (such as ncurses)
This is good because you don't have to dig into the system specific details. Drawback is that if you are doing a really simple application, it may be a bit of "sledghammer to crack nut" approach.

- Implement one or more system specific functions to do this.
This means understanding (or finding someone else who understands) the system architecture and fidning the right way to turn off the echo to console.

If you actualy want stars to appear as you type, you'll also have to "disable cooking" - cooking is where the user enters a whole line of text at once, and the application doesn't see the backspace/delete presses that the user may have done to correct the input. This is another, closely related function to the "disable echo" [actually, it's usually just another flag to say "Disable cooking" along with the "Disable Echo" flag].

You can't use fgets() if you want stars to appear as they are typed tho', as fgets still waits for the whole line to be complete. You'll have to use getchar() or some such.

I have written code for this on Unix/Linux, OS/2 and Windows at different times.

If you tell us what system you need this for, then I'm sure someone here can tell you how to do it.

--
Mats

If you're using VC++, it's extremely easy - just use getch() and print out a '*'.

http://board.theprogrammingsite.com/viewtopic.php?t=113

Quote:

---

Except that you have to push enter after entering a character

---

Oh yeah I forgot about that :/

Quote:

---

http://board.theprogrammingsite.com/viewtopic.php?t=113

---

I tried the function using DevC++ but It dosent seem as if it will work because of the getch(). And it dosent seem as if getch() is featured in DevC++ either, or at least so it says here .

The only way I know how to do keyboard event polling in C/C++ is using SDL, but that would be entirely inappropriate for this. So yeah maybe something like ncurses would be best here.

You can use getche() in Dev-C++. You just have to erase the characters that are echoed. I suggest

Code:

---

printf("\b*");

---

In Dev-C++, getch() is defined as (at least on my version)

Code:

---

#define getch() getchar()

---

so it doesn't do what you're looking for.

ncurses might still be a good idea, though, especially if you're doing other screen manipulation.

Oh ok, but wouldent it be the same as getchar then?

>Oh ok, but wouldent it be the same as getchar then?
Yep, and that's why getch is implementation-dependent. ;)

I am programming for Windows. Even though I would like it to be portable, I still don't mind to have it system specific.

Thanks for the replys :)

Code:

---

#include <windows.h>
...
DWORD origKBMode = 0;
...
void SetKbdModeRaw(void)
{
        DWORD mode;
        GetConsoleMode(GetStdHandle(STD_INPUT_HANDLE), &mode);
        if (origKBMode == 0)
                origKBMode = mode;
        mode &= ~(ENABLE_ECHO_INPUT | ENABLE_LINE_INPUT);
        SetConsoleMode(GetStdHandle(STD_INPUT_HANDLE), mode);
}

void RestoreKbdMode(void)
{
        SetConsoleMode(GetStdHandle(STD_INPUT_HANDLE), origKBMode);
}

---

In your code, call SetKbdModeRaw() and when you have got the password, call RestoreKbdMode().

However, it seems that the standard C functions don't quite work right with this - so you may still be better off using getch(). I think the problem has to do with line endings.

--
Mats

Something I made awhile ago:

Code:

---

char *getPass(char *szBuffer, size_t len)
{
        size_t i;
        HANDLE hIn = GetStdHandle(STD_INPUT_HANDLE);
        HANDLE hOut = GetStdHandle(STD_OUTPUT_HANDLE);
        DWORD dwOld, dwNumRead, dwNumWritten;
        if((hIn != INVALID_HANDLE_VALUE) && (hOut != INVALID_HANDLE_VALUE))
        {
                if(GetConsoleMode(hIn,&dwOld))
                {
                        if(SetConsoleMode(hIn,ENABLE_PROCESSED_INPUT))
                        {
                                for(i=0;i<len-1;i++)
                                {
                                        if(ReadConsole(hIn,&szBuffer[i],1,&dwNumRead,NULL))
                                        {
                                                if(szBuffer[i] == '\r')
                                                {
                                                        break;
                                                }
                                                else WriteConsole(hOut,"*",1,&dwNumWritten,NULL);
                                        }
                                        else break;
                                }
                                WriteConsole(hOut,"\n",1,&dwNumWritten,NULL);
                                szBuffer[i] = '\0';
                                SetConsoleMode(hIn,dwOld);
                                return szBuffer;
                        }
                }
        }
        return NULL;
}

---

Use it like fgets(). As was mentioned, the C buffers might not be perfectly setup with the buffers used here (since the C setup wraps the Windows API buffers). Beware.

OK thanks I'll try to try them today. But I don't really understand what you mean by

Quote:

---

the C buffers might not be perfectly setup with the buffers used here (since the C setup wraps the Windows API buffers).

---

Do you mean that other functions might not work well with the password array after using these functions? or will all buffers mess up?

Quote:

---

Originally Posted by dwks

You can use getche() in Dev-C++. You just have to erase the characters that are echoed. I suggest

Code:

---

printf("\b*");

---

In Dev-C++, getch() is defined as (at least on my version)

Code:

---

#define getch() getchar()

---

so it doesn't do what you're looking for.

ncurses might still be a good idea, though, especially if you're doing other screen manipulation.

---

getch() is a macro for getchar() in the Dev-C++ 4.0 version, but it works as expected in 5.0 (or 4.9 as it may be, cause it's still technically beta).

getch() is something I've been meaning to look into for a while.
MacGyver's code is very nice for getting a passwork but it's not quite getch().
... but that and Mats's samples prompted me to see if have finally learned enough
to put something together. . I think I got something working pretty well in windows.
I wonder how conio.h's really works.
I started down the mode road but found that a mode change was not necessary. . (I was suprised).

Code:

---

                        /*  mygetch.h  */
#include <stdio.h>
#include <windows.h>

char mygetch(void)
{
  static HANDLE hIn;
  static DWORD  NumRead;
  static INPUT_RECORD InRec;
  static char c;

  hIn = GetStdHandle(STD_INPUT_HANDLE);
  if(hIn == INVALID_HANDLE_VALUE)
  {
    printf("GetStdHandle poop");
  }
  else
  {
    do
    {
      ReadConsoleInput(hIn, &InRec, 5, &NumRead);
      if (InRec.EventType == KEY_EVENT)
      {
        if (InRec.Event.KeyEvent.bKeyDown == 1)
        {
          c = InRec.Event.KeyEvent.uChar.AsciiChar;
          /* testing print
          printf("  KDown  Repeat  KeyCode  ScanCode  Unicode  Ascii  Ctrl-State \n");
          printf("  &#37;3x    %3x    %3x      %3x      %3x      %3x    %3lx \n",
                  InRec.Event.KeyEvent.bKeyDown,
                  InRec.Event.KeyEvent.wRepeatCount,
                  InRec.Event.KeyEvent.wVirtualKeyCode,
                  InRec.Event.KeyEvent.wVirtualScanCode,
                  InRec.Event.KeyEvent.uChar.UnicodeChar,
                  InRec.Event.KeyEvent.uChar.AsciiChar,
                  InRec.Event.KeyEvent.dwControlKeyState );
          */
          /* printf("|if %c %02x ", c, c);  testing*/
          break;
        }
      }
    }
    while( c !=  '\n' );
  }
  return c;
}

---

... and a password calling program:

Code:

---

/*  mygetch3.c          program for calling mygetch()  */
#include <stdio.h>
#include "mygetch3.h"

int main(void)
{
  #define len 21

  char uname[len] = {0};
  char passwd[len] = {0};
  unsigned char c = 0;
  int i, maxchars = (len-1);

  printf("\nEnter %d chars max of whatever... wytiwyg \n", maxchars);
  printf("Username: ");
  for(i = 0; i < maxchars; i++)
  {
    c = getchar();
    if(c == '\n')
    {
      break;
    }
    else
    {
      uname[i] = c;
    }
  }
  uname[i] = '\0';

  c = 0;
  printf("\nSpaces are ok, 'X' indicates illegal character and not used. \n");
  printf("Password: ");
  for(i = 0; i < maxchars; i++)
  {
    c = mygetch();
    /* printf("back from mygetch: c= %c 0x%02x \n", c, c);  testing */

    if(c == 0x0d)
    {
      break;
    }
    else
    {
      if(c > 0x19 && c < 0xfe)  /* legal range (look it up in an ascii chart) */
      {
        passwd[i] = c;
        /*putchar('*');*/                  /* if you want the asterisk */
        /*printf(" HEY c= 0x%02x  ", c);  testing */
          }
          else
          {
        putchar( 0x07 );
        putchar('X');  /* indicates illegal character to user */
        i--;          /* rewind i one */
      }
    }
  }
  passwd[i] = '\0';

  printf("\n\nYou typed: \n");
  printf("Username: %s \n", uname);
  printf("Password: %s \n\n", passwd);

  /* testing EXACTLY what is stored */
  for(i = 0; i <= maxchars; i++)
  {
    printf("%2d: %c , 0x%02x \n", i, passwd[i], passwd[i]);
  }
  return 0;
}

---

Now I wonder how could this be done in linux without using ncurses.
Are there system functions like win32 API to use???
++Howard;

Code:

---

if(c > 0x19 && c < 0xfe)  /* legal range (look it up in an ascii chart) */

---

Why not use the portable function isprint() from <ctype.h>? . . .

I didn't read the whole topic but...

You should definitely recheck your ASCII table... 0x19 to 0x1F ARE controls characters (so is 7F)... and by the way ASCII is defined from 0x00 to 0x7F (that's it, it's a 7 bits encoding set...).

I agree that using the value expressed in hexadecimal to check if the character is part of the printable characters of the ASCII set doesn't look really clean. But this is quite portable, i mean, every computer/OS is conform to ASCII for defining the first "128 characters", your code will work well except for some retard on EBCDIC or i don't know what... :D

I didn't imply that the code given would not work with an ASCII character set. I just didn't feel like checking my ASCII chart, because I find

Code:

---

if(isprint(c))

---

so much easier to read. I mean, why not use it? It's easier to read, it's shorter, and on the off chance the user is using EBCDIC or some other exotic character set, it will still work.

I agree with you. It's 100% more clearer to do this that way (and yeah, a little bit safer).

Quote:

---

Originally Posted by Abda92

OK thanks I'll try to try them today. But I don't really understand what you mean by
Do you mean that other functions might not work well with the password array after using these functions? or will all buffers mess up?

---

stdin might not be properly sync'ed up with the Windows buffer for stdin.

You have data to be read and Windows buffers it for you. Then you have the C standard library which reads from the Windows buffer, but it buffers that, too. Hence, if you clear the Windows buffer, and expect the C buffer for stdin to be cleared, you may get unexpected results.

Quote:

---

Why not use the portable function isprint() from <ctype.h>? . . .

---

I don't know... I didn't think of it? . I'm not in the habit of using those fancy things. . I have a tendency to try to practice handling things like this myself which you can clearly see I need from this:

Quote:

---

You should definitely recheck your ASCII table... 0x19 to 0x1F ARE controls characters (so is 7F)... and by the way ASCII is defined from 0x00 to 0x7F (that's it, it's a 7 bits encoding set...).

---

Code:

---

if(c > 0x19 && c < 0xfe)

---

0x19 , duh... I had started at 0x20 to skip the space but then decided to include.
...so my thinking: 19 is one less than 20 isn't it? hahaha ...right, start at 0x1f.
...and 0xfe - duh again! msb is 1 starting at 0x80....
sheez , I don't know what I was thinking there. . I guess my brain was busy thinking about reading the input . . Please correct to:

Code:

---

if(c > 0x1f && c < 0x7f)

---

Sorry to post that error. . I will try to be more careful.
Please point out any others you notice.
--Howard;

I'm sorry, I'm having a bit of a hard time understanding all these new functions. Thanks for posting them anyway.

But I'm thinking of just outputting *s after the password was input, but I don't know how to shift the cursor up 1 line (since it will go down when the user preaaes enter).
I've tried '\b' and "\b\b" but none worked.

Anyone know a way to do this?

you are kidding.... haven't you been paying attention? here:

Code:

---

/* getchdemo.c    real conio.h  getch()  behavior
- for many windows compilers but not all ,
- and NOT linux which you will need to use the getch() in  curses.h  */
#include <stdio.h>
#include <conio.h>

int main(void)
{
  char c, passwd[20] = {0};
  int i, maxchars, ctrl;

  i = ctrl = 0;
  maxchars = (sizeof(passwd) - 1);

  printf("\nEnter Password: ");
  while( (c = getch()) != 0x0d)
  {
    if(c > 0x20 && c < 0x7e && ctrl == 0)
    {
      putchar('*');
      passwd[i++] = c;
      ctrl = 0;
      if(i > maxchars)
      {
        break;
      }
    }
    else
    {
      putchar('X');
      if(c < 0x20)
      {
        ctrl = 1;
      }
    }
  }
  passwd[i] = '\0';
  putchar('\n');
  printf("\n  Password is: &#37;s \n", passwd);

  return 0;
}

---

I'm sorry, but can I ask why we are using '\r' and not '\n'?

EDIT: man! when I finally understood how to use this, I found out my compiler doesn't support conio.h

Now what do I do? I searched the internet for the file, but I read that the header file won't be enough since its functions are not in the library.

>I'm sorry, but can I ask why we are using '\r' and not '\n'?
It's a non-portable hack to get around newline conversion issues. Normally, a C input function will take whatever newline combination the system has and convert it to '\n'. C output functions will perform the inverse. However, when you use a raw input function like getch, or ReadFile (assuming Windows because it uses CRLF for newlines), that conversion isn't done. So you have to work around it by being more selective in the characters you test for.

but I can't get getch() to work since my compiler doesn't have conio.h
I'm using cygwin on windows which I believe uses the GCC compiler.

>I'm using cygwin on windows which I believe uses the GCC compiler.
Maybe the POSIX solution will work for you then:

Code:

---

#include <termios.h>
#include <unistd.h>
#include <stdio.h>

int getch ( void )
{
  struct termios term, save;
  int c;

  /* Get the old terminal and save it */
  tcgetattr ( STDIN_FILENO, &term );
  save = term;

  /* Enter non-canonical mode */
  term.c_lflag &= ~ICANON;
  term.c_lflag &= ~ECHO;
  term.c_cc[VMIN] = 1;
  term.c_cc[VTIME] = 0;

  /* Apply the new settings */
  tcsetattr ( STDIN_FILENO, TCSANOW, &term );

  /* getch! */
  c = getchar();

  /* Restore the original terminal */
  tcsetattr ( STDIN_FILENO, TCSANOW, &save );

  return c;
}

---

Cygwin has windows.h doesn't it? . If so , won't the mygetch() I posted work?
- copy that into a file called "mygetch.h"
- place that file in the same directory as your program
- add the following to your program's header:

Code:

---

#include "mygetch.h"

---

or include it right into your program by:
- copy it into the bottom of your program as a function.
- add the following to your program's header:

Code:

---

#include windows.h
...
char mygetch(void);      /* function 'protocol' */

---

I'd be interested to know if it works for others too ,, I think it will...

OK. Everything went good except for a few issues:
1. I have an output (printf) before the password is input, and it only appears after it has been input.
2. The stars are output with the output above, after the whole password is input.
3. If the maximum number of characters is input, the program just continues. I would like it to continue only after enter is input.

What I really don't understand are the first two points. For some reason the program is keeping the output buffer until after the password is input. Any explanation?

Thanks for the help

>1. I have an output (printf) before the password is input, and it only appears after it has been input.
This is a buffering problem. You need to print a newline or flush the stream (or pray the buffer gets filled up at the right time):

Code:

---

printf ( "Blah blah blah\n" ); /* Flushes automagically */

printf ( "Ask for input: " ); /* Doesn't flush automatically */
fflush ( stdout ); /* Force a flush */

---

>2. The stars are output with the output above, after the whole password is input.
>3. If the maximum number of characters is input, the program just continues.
Post your code. These sound like flaws in your logic.

Quote:

---

Originally Posted by Abda92

OK. Everything went good except for a few issues:
1. I have an output (printf) before the password is input, and it only appears after it has been input.

---

Code:

---

fflush(stdout);

---

before the password request.

Quote:

---

2. The stars are output with the output above, after the whole password is input.
3. If the maximum number of characters is input, the program just continues. I would like it to continue only after enter is input.

Thanks for the help

---

You'll have to show the code for password input for this to be answerable - I presume it is one of the several varieties posted above, but I don't know which version you are currently using.

I think #2 may be solved by same method as #1 - you need to fflush(stdout) after each star is printed.

--
Mats

I'm sorry, I forgot to post my code. Here's the password input function:

Code:

---

void getpassword(char password[], int maxlength)
{
        int i;
        char c;

        printf("Please input password (max. %d characters): ", KEYLENGTH);

        for (i=0; i<maxlength; i++)
        {
                if ((c=mygetch()) == '\r') break;
                password[i] = c;
                if (c != '\b') putchar('*');
                else
                {
                        putchar('\b');
                        i--;
                }
        }
        password[i] = '\0';
}

---

I hope this helps

will just increasing the number of characters being input and save only the first "maxlength" characters fix problem #3?

Never mind, I fixed all the problems except one: backspace.
I just made the condition for the loog maxlength+1 to give the user a chance to press enter.

Code:

---

void getpassword(char password[], int maxlength)
{
        int i;
        char c;

        printf("Please input password (max. %d characters): ", KEYLENGTH);
        fflush(stdout);

        for (i=0; i<maxlength+1; i++)        /* maxlength+1 just to allow the user to press enter. Or else program continues as soon as 12th char is input */
        {
                if ((c=mygetch()) == '\r') break;
                if (i<maxlength) password[i] = c;
                if (c != '\b') putchar('*');
                else
                {
                        putchar('\b');
                        i--;
                }
                fflush(stdout);
        }
        password[i] = '\0';
}

---

You might be thinking why I put the following if statement:

Code:

---

                if (i<maxlength) password[i] = c;

---

For some reason if I don't, it just overflows the array and saves the unwanted characters, even though password has been declared as

Code:

---

char password[maxlength+1];

---

Now my problem is the backspace. Even though I output it (just to remove the star) and decrement i it still saves it in the array. What can I do?

MAN! Each time I fix a problem, another one comes out of nowhere!
I fixed the backspace, I just needed to decrement i twice.
but now when the user inputs more than 12 characters, it keeps on taking characters in, which is not bad. The problem is that the last of these unwanted characters replaces the last of the wanted characters.
e.g. If the user inputs "abcdefghijklmnop" the password is saved as "abcdefghijkp".

Now what :( ?

EDIT: btw, here's the new code:

Code:

---

void getpassword(char password[], int maxlength)
{
        int i;
        char c;

        printf("Please input password (max. %d characters): ", KEYLENGTH);
        fflush(stdout);

        for (i=0; i<maxlength+1; i++)        /* maxlength+1 just to allow the user to press enter. If not +1 program continues as soon as 12th char is input */
        {
                if ((c=mygetch()) == '\r') break;
                if (i<maxlength && c != '\b')        /* save character in password */
                {
                        password[i] = c;
                        putchar('*');
                }
                else if (c == '\b')                /* perform backspace */
                {
                        putchar('\b');
                        i -= 2;
                }
                else if (c != '\b')                /* just to let the program continue looping. all extra characters are IGNORED */
                {
                        putchar('\b');
                        i--;
                }
                fflush(stdout);
        }
        password[i] = '\0';
}

---

Using your last:
void getpassword(char password[], int maxlength)
...and
char mygetch(void)
...from above along with the following main():

Code:

---

#include <stdio.h>
#include <windows.h>
#define  KEYLENGTH 15

void PAUSE(void){int c; while( (c=getchar()) != '\n' && c != EOF);}
void getpassword(char password[], int maxlength);
char mygetch(void);

int main(void)
{
  int  maxlength = 15;
  char password[KEYLENGTH + 1]      = {0};

  void PAUSE(void){int c; while( (c=getchar()) != '\n' && c != EOF);}
  getpassword(password, maxlength);
  printf("\n\npassword= &#37;s \n", password);
  getchar();
  return 0;
}

---

I get the following:

Code:

---

/* I type letters a thru q: */

Please input password (max. 15 characters): ***************
password= abcdefghijklmno
/*******************************************************/
/* I type digits 1 thru 0 twice (20 characters)

Please input password (max. 15 characters): ***************
password= 123456789012345

---

The cursor moves back after 15 chars, but nothing is erased.
(why are you doing that anyhow....)
Also, in getpassword() :
'i' may never reach maxlength because of all the decrementing.

I get same behavior with or without fflush(stdout):
program overruns the getchar() at end of main because of (stdin) leftovers.
Try that PAUSE() function up there instead of fflush() at end of your getpassword():

Code:

---

...snip...
        /* fflush(stdout); */
    }
    password[i] = '\0';
    PAUSE();
}                    /* end of getpassword() */

---

So... What's the problem?
I am on a '98 msdos console. Perhaps XP or Vista consoles behave differently.

If you want to do a "proper" backspace, you should probably do

Code:

---

puts("\b \b");

---

Also, don't use a for-loop for the password entry, use a while-loop.

Only increment the chars when accepted, and if backspace is entered, remove one letter (if there's anything already entered), by printing a backspace and decrementing the length of the string.

When you see an enter, it's finished.

I'm pretty sure the fflush is needed at each iteration of the loop, so don't listen to HowardL on that one.



--
Mats

Code:

---

puts("\b \b");

---

Actually, since puts() prints a newline at the end, perhaps this would be more appropriate:

Code:

---

printf("\b \b");

---

Quote:

---

Originally Posted by dwks

Code:

---

puts("\b \b");

---

Actually, since puts() prints a newline at the end, perhaps this would be more appropriate:

Code:

---

printf("\b \b");

---

---

Yeah, ok, if you insist :-)

--
Mats

re:' \b's
Oh , I see. You are giving the user the ability to correct input... and it works. Nifty. Sorry, I did not get that before...

Quote:

---

I'm pretty sure the fflush is needed at each iteration of the loop, so don't listen to HowardL on that one.

---

I still notice no difference with or without fflush(stdout)'s.
I don't understand, could you explain:
what might be left unprinted in stdout and why it would be there?

I was suggesting PAUSE(); to unload stdin which still contains at least one character as it leaves getpassword() (...at least the last one posted above does).
It might be the' \n' after '\r' from the '\r\n' produced when pressing ENTER to end input.
Does the XP console behave differently in these respects than my 98 console?
Thanks, Howard;

Quote:

---

Originally Posted by HowardL

re:' \b's
Oh , I see. You are giving the user the ability to correct input... and it works. Nifty. Sorry, I did not get that before...


I still notice no difference with or without fflush(stdout)'s.
I don't understand, could you explain:
what might be left unprinted in stdout and why it would be there?

---

It is common for implementations of file-io (stdio.h) to not flush every single write immediately, but to buffer up several operations together. It depends on which compiler (and related library functions you use). fflush(stdout) won't hurt and it makes it safe - this isn't a performance critical section of the code anwyays, right?

Quote:

---

I was suggesting PAUSE(); to unload stdin which still contains at least one character as it leaves getpassword() (...at least the last one posted above does).
It might be the' \n' after '\r' from the '\r\n' produced when pressing ENTER to end input.
Does the XP console behave differently in these respects than my 98 console?
Thanks, Howard;

---

Well, yes, clearing the input buffer if the password was too long for the valid input is a good idea, indeed. But it's not a replacement for fflush().

--
Mats

OK everything works fine now. I had to add a validation that the character is a printing one since mygetch() takes in none-printing ones too. Here's the new function if anyone wants it:

Code:

---

void getpassword(char password[], int maxlength)
{
        int i=0;
        char c;

        printf("Please input password (max. %d characters): ", KEYLENGTH);
        fflush(stdout);

        while (i <= maxlength)        /* just to allow the user to press enter or enter extra IGNORED characters. If not +1 program continues as soon as 12th char is input */
        {
                if ((c=mygetch()) == '\r') break;
                if (i<maxlength && c != '\b' && (c >= 0x21 && c <= 0x7e))        /* save character in password as long as it's not a none-printing character */
                {
                        password[i++] = c;
                        putchar('*');
                }
                else if (c == '\b' && i > 0)                /* perform backspace only if characters have already been input */
                {
                        printf("\b \b");
                        i--;
                }
                fflush(stdout);
        }
        password[i] = '\0';
}

---

Thanks again for all the help. I hope someone else benefits from this code too.

I would use a switch instead of several if-statements, something like this:

Code:

---

  int done = 0;
...
  while(!done) {
      c=mygetch();
      switch(c) {
        case '\r':
        case '\n':  // Just in case.
            done = 1;
            break;
        case '\b':
            if (i > 0)  {
                ..
            }
            break;
        default:
            if (isprint(c) && i < maxlength) {
                ...
            }
            break;
...

---

Note that the above code is designed to ALWAYS exit when the user presses enter, rather than leaving some "leftovers" in the input buffer, no matter how much input is given - it is just ignored. So if someone types in
SomeReallyVeyLongPasswordThatDoesntFit
you won't have some parts of it still sitting in the input buffer.

Also, this comment doesn't make sense (in relation to the code):

Code:

---

/* just to allow the user to press enter or enter extra IGNORED characters. If not +1 program continues as soon as 12th char is input */

---

I use "isprint()" to see if something is a valid character, rather than checking ascii values. It is better out of two perspectives:
1. it allows any printable character, which is probably what you want - even if they aren't in the original ascii table, such as ä, å etc. No reason NOT to allow those.
2. It is much more straight forward a check than the two numeric values you use, and doesn't need any explanation to anyone else reading the code that may not be quite so clued up on ascii characters.
3. [For the benefit of the pedants that like pointing these things out] it works for other character sets than ASCII.

If you explicitly don't want spaces in the password, you may want to add "!iswhite(c)" on to the conditions for adding characters to the string. I personally would prefer to just allow spaces, here, and if spaces are a nuisance (or some other way not valid as part of a password), make sure that spaces aren't allowed when you SET the password - it improves the security somewhat to not give away which characters are valid and invalid when you enter the password.

--
Mats

Quote:

---

Originally Posted by matsp

I use "isprint()" to see if something is a valid character, rather than checking ascii values. It is better out of two perspectives:
1. it allows any printable character, which is probably what you want - even if they aren't in the original ascii table, such as ä, å etc. No reason NOT to allow those.
2. It is much more straight forward a check than the two numeric values you use, and doesn't need any explanation to anyone else reading the code that may not be quite so clued up on ascii characters.
3. [For the benefit of the pedants that like pointing these things out] it works for other character sets than ASCII.

---

You should also add:
4. The code has already been written and thoroughly tested, so you know it works. There's no point in reinventing the wheel. Unlike code that you write, the standard functions are virtually guaranteed not to have bugs.

No software is bug-free. ;) http://sources.redhat.com/bugzilla/b...op&value0-0-0=

But the standard functions are very, very well tested and the ANSI standard functions "are virtually guaranteed not to have bugs".