Yes that's right, effect of fflush is undefined for stdin and it of course must not be used. But if they already do things insecurely, then they must use other uncertain things to compensate it, nothing to do, their choice. Then i say again that these who read would better remember, use only fgets for input. And if you use anything else for input, then delete all rubbish and use only fgets for input.