[wp-hackers] Changeset 11804

[Otto]

On Tue, Aug 11, 2009 at 2:32 PM, Chris Jean<gaarai at gaarai.com> wrote:
> The code actually has that exact test in it. wp-login.php line 190-191:
>
>    if ( empty( $key ) )
>        return new WP_Error('invalid_key', __('Invalid key'));
>
> What it's not doing is a check for an array, which is why this works. So
> not only do you have to validate, you have to type check.

I don't follow that. An empty array is still empty.

http://php.net/manual/en/function.empty.php

 The following things are considered to be empty:

    * "" (an empty string)
    * 0 (0 as an integer)
    * "0" (0 as a string)
    * NULL
    * FALSE
    * array() (an empty array)
    * var $var; (a variable declared, but without a value in a class)


-Otto
Sent from Memphis, TN, United States