diff --git a/includes/common.inc b/includes/common.inc
index 0a3ed73..2eeaf61 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -1988,7 +1988,12 @@ function _format_date_callback(array $matches = NULL, $new_langcode = NULL) {
  *   printed to the page.
  */
 function format_username($account) {
-  $name = !empty($account->name) ? $account->name : variable_get('anonymous', t('Anonymous'));
+  if (isset($account->name) && ($account->name !== '')) {
+    $name = $account->name;
+  }
+  else {
+    $name = variable_get('anonymous', t('Anonymous'));
+  }
   drupal_alter('username', $name, $account);
   return $name;
 }
diff --git a/modules/user/user.module b/modules/user/user.module
index 7f22f7c..9d486a5 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -607,7 +607,7 @@ function user_save($account, $edit = array(), $category = 'account') {
  * Verify the syntax of the given name.
  */
 function user_validate_name($name) {
-  if (!$name) {
+  if ($name === '') {
     return t('You must enter a username.');
   }
   if (substr($name, 0, 1) == ' ') {
@@ -2067,7 +2067,7 @@ function user_login_default_validators() {
  * A FAPI validate handler. Sets an error if supplied username has been blocked.
  */
 function user_login_name_validate($form, &$form_state) {
-  if (isset($form_state['values']['name']) && user_is_blocked($form_state['values']['name'])) {
+  if (isset($form_state['values']['name']) && ($form_state['values']['name'] !== '') && user_is_blocked($form_state['values']['name'])) {
     // Blocked in user administration.
     form_set_error('name', t('The username %name has not been activated or is blocked.', array('%name' => $form_state['values']['name'])));
   }
@@ -2080,7 +2080,7 @@ function user_login_name_validate($form, &$form_state) {
  */
 function user_login_authenticate_validate($form, &$form_state) {
   $password = trim($form_state['values']['pass']);
-  if (!empty($form_state['values']['name']) && !empty($password)) {
+  if (isset($form_state['values']['name']) && ($form_state['values']['name'] !== '') && !empty($password)) {
     // Do not allow any login from the current user's IP if the limit has been
     // reached. Default is 50 failed attempts allowed in one hour. This is
     // independent of the per-user limit to catch attempts from one IP to log
@@ -2167,7 +2167,7 @@ function user_login_final_validate($form, &$form_state) {
  */
 function user_authenticate($name, $password) {
   $uid = FALSE;
-  if (!empty($name) && !empty($password)) {
+  if (isset($name) && ($name !== '') && !empty($password)) {
     $account = user_load_by_name($name);
     if ($account) {
       // Allow alternate password hashing schemes.