Avoid the use of numerical values in code ("magic numbers") when possible. Reasons for this include, appropriately named symbolic constants make code more readable rather than checks against a specific number. For portability reasons also if a specific number needs to be changed reassigning a symbolic value is much easier than replacing a specific number in the code since each case has to be checked specifically.
Non Compliant Code:
if(age>=18) { takevote(personID); } /*Various Processing code*/ if (age<=18) { checkSchoolEnrollment(personID); }
Compliant Code:
if(age>=ADULT_AGE) { takevote(personID); } /*Various Processing code*/ if (age<=ADULT_AGE) { checkSchoolEnrollment(personID); } Â
In the compliant code it is easy to check if the user is an adult and process accordingly. If the definition of adult changes during iterations of the codebase it is much simpler to replace the value for ADULT_AGE then search for instance of 18 and see if they're appropriate for change.
Risk Assessment
Mistakes regarding numeric values can cause unintended consequences if changes are not made uniformly
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
EXP00-A |
1 (low) |
1(unlikely) |
2 (medium) |
P2 |
L3 |
Source: http://www.doc.ic.ac.uk/lab/cplus/c++.rules/chap10.html