I wrote that. This is a classic newbie programmer mistake, to forget about edge cases. https://en.wikipedia.org/wiki/Edge_case
I haven't written that much code in my life but I knew not to do that when I was like 17 years old.
Also, you should check out the username sanitiser. It uses, I kid you not, a complex switch statement, not, like everyone else in the industry uses, a one line regular expression. It was so convoluted I missed the fact that the period '.' was an allowable character except at the edges of a 16 character string. I wrote the proper regex and gave it to @someguy123 for his anonsteem site, as I was going to make my own 'Sybil Workshop'. My code also did not require the user to ever have the webserver see the original secret, it was a html page you were instructed to download and run with the network turned off.
My buddy @voluntary, here, also is a big student of Bruce Schneier, and you don't have to read many of his blogs to learn what a farce most electronic security systems actually are.