Why scanf must take the address of operator

As the title says, I always wonder why scanf must take the address of operator (&).

Because C only has "pass-by-value" parameters, so to pass a 'variable' to put a value into, you have to pass its address (or a pointer to the variable).

scanf does not take "the address of operator (&)". It takes a pointer. Most often the pointer to the output variable is gotten by using the address-of operator in the scanf call, e.g.

int i;
scanf("%i", &i);
printf("number is: %d\n", i);

But that is not the only way to do it. The following is just as valid:

int *iPtr = malloc(sizeof(int));
scanf("%i", iPtr);
printf("number is: %d\n", *iPtr);

Likewise we can do the same thing with the following code:

int i;
int *iPtr = &i;
scanf("%i", iPtr);
printf("number is: %d\n", i);

Because it needs the address to place the value it reads. If you declare you variable as a pointer, the scanf will not need the &.

Everyone else has described well that sscanf needs to put its output somewhere, but why not return it? Becuase it has to return many things - it can fill in more than one variable (driven by the formatting) and it returns an int indicating how many of those variables it filled in.