Since the printf() function takes strings as arguments, you might think that you do not need the format specifier “%s” while printing a string.
Example:

int main()
{
  char string[30]="Hello c programers";
  printf(string);
  return 0;
 
}

However, this can be very dangerous. What if your string includes a format specifier like %s or %d?

Because printf is a varargs function, it uses the format string to decide how many arguments it takes.

If you provide one argument, but put in the format specifier, it will assume it has more arguments than it does, and read them off the stack. This will cause it to print out data from stack memory for those format strings.

This can reveal information about the state of your program’s memory to an attacker who adds format specifiers to the string or just cause bugs.

Don’t do it!