Robust and secure programming: checking if a string is empty

The idea

Robust programs must not assume that a user has typed something. Before using a string, a program can test whether it is empty, meaning it contains no characters at all. In many languages the length of the string is checked: if the length equals zero, the string is empty. For example, after reading a name with an input statement, the program can compare the length of the stored string with 0 and, if it matches, display a message asking the user to enter a value and read the input again. This is a validation check on presence rather than on content: a string containing only spaces has a non-zero length, so a length test alone will not reject it. Learners should recognise the empty-string test, know what condition it uses, and understand why it belongs in robust and secure programming: it prevents later code from processing missing data.

What earns the marks

• An empty string is a string containing no characters, so its length is 0.
• The check typically compares the length of the string with 0 (or tests equality to an empty string literal).
• If the condition is true, the program should reject the input, display a suitable message and re-read the value.
• The check is a presence/validation check and does not by itself reject strings made only of spaces.
• Placing the check before the string is used prevents errors caused by missing data.

Common mistakes and how to put them right

• Thinking an empty string is the same as a string containing a space.

  Put it right: Test length against 0, and treat whitespace-only input as a separate case.

• Assuming the check confirms the data is valid in every way.

  Put it right: Combine it with other validation such as range or format checks.

• Believing the test should run after the value has been used.

  Put it right: , perform the check immediately after input and before processing.

Exam tips

• State the condition precisely, for example that the length of the string equals 0.
• Explain the consequence of a true result: reject, message and re-prompt.
• Link the check to robust programming by saying it prevents the program from processing missing input.