# MSVC: error C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead

**Code:** `C4996` · **Category:** C/C++ · **Seen on:** C/C++, MSVC, Windows

Visual C++ treats classic C library functions such as `strcpy`, `sprintf`, `fopen` and `scanf` as deprecated or unsafe and, with SDL checks on, turns the warning into an error.

## Meaning

Microsoft marks functions without bounds checking as unsafe. The message suggests the `_s` variant, which is not portable. The better fix is a bounded standard alternative (`snprintf`, `std::string`, `std::copy`). You can silence it with `_CRT_SECURE_NO_WARNINGS`, but you then keep the buffer-overflow risk.

## Common causes

- Using `strcpy`, `strcat`, `sprintf`, `scanf`, `fopen`, `getenv` in a project with SDL checks enabled
- Visual Studio project defaults (`/sdl`) turning warnings into errors
- `std::copy`/`std::equal` with raw pointers (checked iterators warning C4996)
- Deprecated POSIX names such as `strdup`, `read`, `open`

## Quick fix

1. Replace with safer code: `snprintf`, `std::string`, `std::vector`, or `fopen_s`
2. Define `_CRT_SECURE_NO_WARNINGS` before the includes if you accept the risk
3. Disable SDL checks only for legacy code: Project → C/C++ → General → SDL checks = No

## Detailed fix by platform

### Visual Studio

1. Project Properties → C/C++ → Preprocessor → add `_CRT_SECURE_NO_WARNINGS` (or put `#define _CRT_SECURE_NO_WARNINGS` at the very top of the file)
2. Use `#pragma warning(disable: 4996)` locally only

### CMake

1. `target_compile_definitions(app PRIVATE _CRT_SECURE_NO_WARNINGS)` (MSVC only)

## Code examples

### Portable replacement

```cpp
#include <cstdio>
#include <string>

int main() {
    char buf[16];
    // strcpy(buf, "hello");                      // C4996 on MSVC
    std::snprintf(buf, sizeof buf, "%s", "hello"); // bounded and portable
    std::string s = "hello";                       // best: no buffer at all
}
```

## How to diagnose

1. **Function** — Which function is flagged?
2. **Settings** — SDL checks or warnings-as-errors on?
3. **Portability** — Must the code also build on Linux/macOS?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/cpp/msvc-c4996-unsafe-function)