Earlier quoted context omitted.
Deleting sprintf by itself wouldn't work, even the "safe" replacement functions rely on the developer providing the safety information manually. C needs a string type. Sadly large parts of the C standard are build around turning plain character arrays into exploits by pretending that they are a sane choice for string manipulation.
asprintf is fine for most cases. For the other cases you probably don't want to dynamically allocate memory so snprintf with a fixed buffer size is fine.
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#71Nope, there's still %n in snprintf. snprintf_s is better, but still a security nightmare.