Skip to content

Lab · C Programming (from zero to systems)

Lab: checking UPI IDs

Labbeginner· about 2 hours· 4 steps

The brief

A payments start-up in Bengaluru gets lists of UPI IDs (like asha.k@okaxis) typed by shopkeepers. You write the validation rules in JavaScript and test them here, then build a C program that reads each line safely with fgets, cleans it, validates it with <ctype.h> and splits it into user and bank parts without overflowing a buffer.

Why it matters

Every payment app, bank backend and form checks text before trusting it. In C, text handling is where most security bugs come from: a missing '\0', a newline left in the buffer or a copy without a size limit. Doing it safely with fgets, strcspn, tolower and bounded copies is daily work in systems and embedded jobs, and a common placement interview topic.

Skills you practise

  • fgets and strcspn
  • strlen and %zu
  • tolower and isalnum with unsigned char
  • strchr
  • bounded copies with snprintf
  • AddressSanitizer

You need

  • gcc (Linux, macOS with Xcode command line tools, or Windows with MSYS2 or WSL)
  • Step 4 uses AddressSanitizer: run it on Linux, WSL or macOS (MinGW gcc on Windows does not support it)

What you will have at the end

upi.js with a tested validUpi(), and upi.c: a C program that reads UPI IDs safely with fgets, lower-cases and validates them, splits valid ones with bounded copies, and runs clean under AddressSanitizer.

How it is marked (rubric, 100 points)
Correct resultsEvery check passes: the lengths, valid and invalid for all six IDs, the split parts and Valid IDs: 3 of 6.40
Safe string handlingfgets with sizeof, the newline removed, bounded copies, and no AddressSanitizer or UBSan reports.30
Right use of the librariesstrcspn, strchr, strlen with %zu, and tolower/isalnum/isalpha with an unsigned char cast.20
Clean buildNo warnings with -Wall -Wextra.10

0/4 steps done

Step 1 of 4

The rules, tested in JavaScript

validUpi(id) returns true only for IDs that follow every rule in the comment.

Find the '@' and make sure there is no second one. Split the text into the user part (before) and the bank handle (after), check both lengths, then check every character: letters, digits, '.', '-' and '_' in the user part, letters only in the bank handle.

The C program in step 3 uses the same checks with strchr, strlen and <ctype.h>, so get the logic right here first.

Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.