How Do I Work with Strings as Character Arrays?

After this lesson, you will be able to:

• Explain that C strings are char arrays terminated by '\0'
• Use strlen, strcmp, strcpy, and strcat from <string.h>
• Explain why == compares addresses for strings and use strcmp instead
• Use fgets for safe string input and strip the trailing newline
• Identify buffer overflow risks with strcpy, strcat, and scanf("%s")
• Use <ctype.h> functions to test and convert individual characters

There Is No String Type

In Java, you write:

String name = "Alice";
if (name.equals("Alice")) { ... }
String greeting = "Hello, " + name;

Clean, safe, and object-oriented. Now here’s the C equivalent:

char name[50] = "Alice";
if (strcmp(name, "Alice") == 0) { ... }
// String concatenation? It's... complicated.

C has no String class. A “string” in C is just an array of char that ends with a special byte: '\0' (the null terminator). Every string function — strlen, strcmp, printf("%s") — works by scanning forward until it hits that '\0'. If it’s missing, your program reads off into random memory.

Character Arrays and String Functions

How C Strings Work

When you write:

char greeting[] = "Hello";

C stores this in memory:

Index:   [0]  [1]  [2]  [3]  [4]  [5]
Value:   'H'  'e'  'l'  'l'  'o'  '\0'

The array is 6 bytes — 5 characters plus the null terminator. The '\0' is ASCII value 0, and it marks the end of the string.

Key Insight: A C string is just an array of characters ending with '\0' (the null terminator, ASCII value 0). Every string function — strlen, strcmp, printf("%s") — scans forward until it finds that '\0'. Without it, functions read past the end of your array into garbage memory.

String Library Functions (<string.h>)

strlen — string length (not counting '\0'):

char name[] = "Alice";
printf("%zu\n", strlen(name));    // 5 (not 6!)

strcmp — compare two strings:

if (strcmp(name, "Alice") == 0)       // Equal
if (strcmp(name, "Bob") < 0)          // name comes before "Bob" alphabetically
if (strcmp(name, "Aaron") > 0)        // name comes after "Aaron"

Common Pitfall: NEVER use == to compare strings in C. if (str1 == str2) compares memory addresses, not contents. Two identical strings stored in different locations would compare as “not equal.” Always use strcmp(str1, str2) == 0.

strcpy — copy one string to another:

char dest[50];
strcpy(dest, "Hello");             // dest is now "Hello"

strcat — concatenate (append) strings:

char greeting[50] = "Hello, ";
strcat(greeting, "world!");        // greeting is now "Hello, world!"

Common Pitfall: Both strcpy and strcat don’t check whether the destination buffer is large enough. Copying a 100-character string into a 50-character buffer overflows silently. Always ensure your destination is big enough, or use the safer strncpy/strncat variants.

Reading Strings from Users

scanf("%s") — reads one word (stops at whitespace):

char word[50];
scanf("%s", word);          // Note: no & needed (array name IS an address)

Common Pitfall: scanf("%s") has no way to know how large your buffer is. If the user types 1000 characters into a 50-byte buffer, scanf writes past the end — a buffer overflow. Use fgets for safe input.

fgets — reads a full line (safe):

char line[100];
fgets(line, sizeof(line), stdin);

fgets reads at most sizeof(line) - 1 characters, always adds '\0', and includes the newline if the line fits. But that trailing \n is often unwanted:

// Strip the trailing newline
line[strcspn(line, "\n")] = '\0';

The Trick: Use fgets + newline stripping for safe line reading. scanf("%s") stops at whitespace and has no overflow protection. The strcspn approach cleanly removes the trailing newline.

char buffer[100];
gets(buffer);          // NEVER USE THIS — removed from C11

char buffer[100];
fgets(buffer, sizeof(buffer), stdin);   // Safe — reads at most 99 chars + '\0'

Character Functions (<ctype.h>)

Test and convert individual characters:

#include <ctype.h>

char ch = 'a';
if (isalpha(ch))  { ... }    // Is it a letter?
if (isdigit(ch))  { ... }    // Is it a digit?
if (isupper(ch))  { ... }    // Is it uppercase?
char upper = toupper(ch);     // 'A'
char lower = tolower('B');    // 'b'

Java vs. C String Comparison

From Java: Java’s String is an immutable object with methods. C’s “string” is a mutable char array with library functions. There’s no garbage collection, no automatic resizing, no bounds checking. You manage the buffer, you check the bounds, you track the null terminator.

Complete Example: Name Processor

#include <stdio.h>
#include <string.h>
#include <ctype.h>

void capitalize(char str[])
{
    if (strlen(str) > 0)
    {
        str[0] = toupper(str[0]);
    }
}

int main(void)
{
    char first[50];
    char last[50];
    char full[100];

    printf("Enter first name: ");
    fgets(first, sizeof(first), stdin);
    first[strcspn(first, "\n")] = '\0';

    printf("Enter last name: ");
    fgets(last, sizeof(last), stdin);
    last[strcspn(last, "\n")] = '\0';

    capitalize(first);
    capitalize(last);

    strcpy(full, last);
    strcat(full, ", ");
    strcat(full, first);

    printf("Full name: %s\n", full);
    printf("Name length: %zu characters\n", strlen(full));

    return 0;
}

Strings Are Where C Gets Real

The gap between Java and C is widest with strings. Java gives you an immutable, bounds-checked, garbage-collected String object. C gives you a mutable array of bytes with a null terminator and no safety net. This is harder, but it’s also how strings actually work at the hardware level — and understanding this makes you a stronger programmer in any language.

Next: sorting and searching. You’ll implement selection sort on arrays and use it to find medians — building the algorithms by hand that Java’s Arrays.sort() hides from you.

Big Picture: Strings in C are where most security vulnerabilities live. Buffer overflows from strcpy, strcat, and scanf("%s") have caused some of the worst security breaches in computing history. Understanding null terminators and buffer sizes isn’t academic — it’s the foundation of writing secure C code. Every string function you use from here on should make you ask: “Is my buffer big enough?”