Is c language a secure programming language?

Answer 1

C is coming around to being defined as a secure language, but older drafts of C, such as C91 and C99, are inherently insecure. The design philosophy of the day was "trust the programmer," which of course meant that it had to be insecure because the programmer might want to do something unexpected, such as accessing a hardware port directly or dropping in some optimized assembler code that manipulated pointers in an unusual pattern that a specific piece of hardware requires.

Today's C (C11) is more robust and offers new features, and is less likely to "trust the programmer" than older drafts, but it still allows inherently insecure actions. Other languages that are derivatives of C (such as C# or C++) are more secure. For example, C# is staticallyanalyzable-- the Common Language Runtime that underpins this and other .Net languages can assert that the program will not crash, handle memory references incorrectly, or otherwise perform in a way that could cause system instability. Even then, however, a programmer may mark code as "unsafe", which disables static analysis and requires the user to accept the risks of running the application.