How to Concatenate Strings Safely in C

By the end of this page, you will understand why strcat() crashes when used with string literals in C, how C strings are stored in memory, and how to safely build combined strings using writable character arrays or snprintf(). You will also learn common mistakes, safer alternatives, and practical patterns used in real C programs.

In C, a string is usually represented as a null-terminated array of characters.

For example:

char name[] = "Sam";

This creates a writable array in memory:

'S' 'a' 'm' '\0'

But a string literal like this:

"TEXT "

is not a writable destination for strcat(). Even though it looks like a string value, it is stored in read-only memory on many systems. Trying to modify it causes undefined behavior, which often appears as a segmentation fault.

Why strcat() fails here

The function strcat(destination, source) appends source to the end of destination.

That means:

• destination must be a writable character array
• destination must already contain a valid null-terminated string
• destination must have enough extra space to hold the result

So this is wrong:

Think of strcat() like writing extra text onto a label.

• A string literal is like text printed on a glass wall: you can read it, but you should not write on it.
• A character array buffer is like a whiteboard: you can write on it, erase it, and add more text if there is space.

strcat() only works when the first argument is a whiteboard with enough room left.

If you try to append onto a glass wall, it breaks. In C, that "break" often shows up as a segmentation fault.

The basic syntax of strcat() is:

strcat(destination, source);

Correct example with a writable buffer

#include <stdio.h>
#include <string.h>

int main(void) {
    char var[] = "world";
    char message[100] = "TEXT ";

    strcat(message, var);

    printf("%s\n", message);
    return 0;
}

Output:

TEXT world

Why this works

• message is a writable character array
• it starts with the string "TEXT "
• it has enough space for the extra characters in var

Concatenating multiple pieces

Consider this example:

#include <stdio.h>
#include <string.h>

int main(void) {
    char name[] = "Bob";
    char message[20] = "Hello ";

    strcat(message, name);
    printf("%s\n", message);
    return 0;
}

Step-by-step

1. Create name

char name[] = "Bob";

Memory contains:

'B' 'o' 'b' '\0'

2. Create message

char message[20] = "Hello ";

Memory begins as:

String concatenation in C appears in many practical situations:

Building log messages

snprintf(logLine, sizeof(logLine), "ERROR: %s", errorMessage);

Creating file paths

snprintf(path, sizeof(path), "%s/%s", directory, filename);

Formatting API or protocol messages

snprintf(request, sizeof(request), "GET /users/%s HTTP/1.1\r\n", userId);

Combining user-facing text

snprintf(greeting, sizeof(greeting), "Hello, %s!", username);

Generating SQL or command strings carefully

C programs often assemble strings for tools, configuration, or data output. In all of these cases, developers must avoid buffer overflows and must never treat string literals as writable buffers.

In real C codebases, developers usually avoid chaining strcat() on temporary pieces and instead use clearer, safer patterns.

Common patterns

Use snprintf() for formatting

This is very common when combining literals and variables:

char message[256];
snprintf(message, sizeof(message), "User: %s, Age: %d", name, age);

Why it is popular:

• one call instead of many
• easier to read
• respects buffer size
• supports numbers and strings together

Build strings incrementally in a buffer

Sometimes code appends piece by piece:

char buffer[256] = "";
strcat(buffer, prefix);
strcat(buffer, name);
strcat(buffer, suffix);

This works only if the buffer is large enough.

Guard against overflow

Real projects often validate lengths before concatenating:

if (strlen(prefix) + strlen(name) +  < (buffer)) {
    (buffer, prefix);
    (buffer, name);
}

1. Using a string literal as the destination

Broken code:

strcat("TEXT ", var);

Why it fails:

• string literals are not writable destinations

Fix:

char message[100] = "TEXT ";
strcat(message, var);

2. Not allocating enough space

Broken code:

char message[10] = "TEXT ";
strcat(message, "very long value");

Why it fails:

• the result does not fit in the buffer
• this causes buffer overflow and undefined behavior

Fix:

• make the buffer larger
• or calculate the needed size
• or use snprintf()

3. Forgetting to initialize the destination string

Broken code:

char message[100];
strcat(message, );

vs

Quick rules

• strcat(dest, src) appends src to dest
• dest must be writable
• dest must already be a null-terminated string
• dest must have enough free space
• never use a string literal as dest

Safe pattern with strcat()

char message[100] = "Hello ";
strcat(message, name);

Safe pattern with snprintf()

char message[100];
snprintf(message, sizeof(message), "Hello %s", name);

Common bad code

strcat("Hello ", name);   // wrong

Common good code

Why does strcat("TEXT ", var) crash in C?

Because "TEXT " is a string literal, and strcat() tries to modify it. String literals are not valid writable destinations.

Can I concatenate string literals directly in C?

Only at compile time when they are written next to each other:

char s[] = "Hello " "World";

This becomes "Hello World". But that is different from runtime concatenation.

What is the safest way to combine strings in C?

For many cases, use snprintf() with a properly sized buffer.

Do I always need a character array for strcat()?

Yes. The destination must be writable memory containing a valid null-terminated string.

Is const char * safe to use with strcat()?

Not as the destination. A const char * points to data you should not modify.

How do I know how large my buffer should be?

Add the lengths of all strings you want to combine, then add 1 for the null terminator.

• char arrays — writable storage for C strings
• string literals — important because they are not writable destinations
• null terminator — every C string must end with \0
• strcpy() — often used before strcat() when building strings in steps
• snprintf() — safer way to format combined strings
• buffer overflow — major risk when concatenating strings in C
• dynamic memory allocation — useful when string size is not known in advance
• undefined behavior — explains why invalid string writes may crash or behave unpredictably