diff --git a/contrib/adduser.c b/contrib/adduser.c
index 444f8d6ec..5be2205a8 100644
--- a/contrib/adduser.c
+++ b/contrib/adduser.c
@@ -222,7 +222,7 @@ main (void)
 	      printf ("That name is in use, choose another.\n");
 	      done = 0;
 	    }
-	  else if (strchr (usrname, ' ') != NULL)
+	  else if (!!strchr(usrname, ' '))
 	    {
 	      printf ("No spaces in username!!\n");
 	      done = 0;
diff --git a/lib/addgrps.c b/lib/addgrps.c
index b2e17a9dd..97c47e077 100644
--- a/lib/addgrps.c
+++ b/lib/addgrps.c
@@ -14,9 +14,10 @@
 #include "prototypes.h"
 #include "defines.h"
 
-#include <stdio.h>
-#include <grp.h>
 #include <errno.h>
+#include <grp.h>
+#include <stdio.h>
+#include <string.h>
 
 #include "alloc/malloc.h"
 #include "alloc/reallocf.h"
@@ -24,19 +25,19 @@
 
 #ident "$Id$"
 
-#define SEP ",:"
 /*
  * Add groups with names from LIST (separated by commas or colons)
  * to the supplementary group set.  Silently ignore groups which are
- * already there.  Warning: uses strtok().
+ * already there.
  */
-int add_groups (const char *list)
+int
+add_groups(const char *list)
 {
 	GETGROUPS_T *grouplist;
 	size_t i;
 	int ngroups;
 	bool added;
-	char *token;
+	char *g, *p;
 	char buf[1024];
 	int ret;
 	FILE *shadow_logfd = log_get_logfd();
@@ -71,13 +72,13 @@ int add_groups (const char *list)
 	}
 
 	added = false;
-	for (token = strtok (buf, SEP); NULL != token; token = strtok (NULL, SEP)) {
+	p = buf;
+	while (NULL != (g = strsep(&p, ",:"))) {
 		struct group *grp;
 
-		grp = getgrnam (token); /* local, no need for xgetgrnam */
+		grp = getgrnam(g); /* local, no need for xgetgrnam */
 		if (NULL == grp) {
-			fprintf (shadow_logfd, _("Warning: unknown group %s\n"),
-				 token);
+			fprintf(shadow_logfd, _("Warning: unknown group %s\n"), g);
 			continue;
 		}
 
diff --git a/lib/chkname.c b/lib/chkname.c
index 8bde7a2d9..7450319ea 100644
--- a/lib/chkname.c
+++ b/lib/chkname.c
@@ -28,6 +28,7 @@
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <string.h>
 #include <sys/param.h>
 #include <unistd.h>
 
@@ -70,9 +71,9 @@ is_valid_name(const char *name)
          */
 	int numeric;
 
-	if ('\0' == *name ||
-	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
-			      '\0' == name[1])) ||
+	if (strcmp(name, "") == 0 ||
+	    strcmp(name, ".") == 0 ||
+	    strcmp(name, "..") == 0 ||
 	    !((*name >= 'a' && *name <= 'z') ||
 	      (*name >= 'A' && *name <= 'Z') ||
 	      (*name >= '0' && *name <= '9') ||
@@ -92,7 +93,7 @@ is_valid_name(const char *name)
 		      *name == '_' ||
 		      *name == '.' ||
 		      *name == '-' ||
-		      (*name == '$' && name[1] == '\0')
+		      strcmp(name, "$") == 0
 		     ))
 		{
 			errno = EINVAL;
diff --git a/lib/console.c b/lib/console.c
index 7903caa9d..642b3ba33 100644
--- a/lib/console.c
+++ b/lib/console.c
@@ -25,7 +25,8 @@
  * under "cfgin" in config (directly or indirectly). Fallback to default if
  * something is bad.
  */
-static bool is_listed (const char *cfgin, const char *tty, bool def)
+static bool
+is_listed(const char *cfgin, const char *tty, bool def)
 {
 	FILE *fp;
 	char buf[1024], *s;
@@ -48,14 +49,13 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
 
 	if (*cons != '/') {
 		char *pbuf;
+
 		STRTCPY(buf, cons);
-		pbuf = &buf[0];
-		while ((s = strtok (pbuf, ":")) != NULL) {
+		pbuf = buf;
+		while (NULL != (s = strsep(&pbuf, ":"))) {
 			if (strcmp (s, tty) == 0) {
 				return true;
 			}
-
-			pbuf = NULL;
 		}
 		return false;
 	}
diff --git a/lib/env.c b/lib/env.c
index 9cb313712..a49648d8b 100644
--- a/lib/env.c
+++ b/lib/env.c
@@ -201,7 +201,8 @@ void set_env (int argc, char *const *argv)
  * but... I feel better with that silly precaution. -j.
  */
 
-void sanitize_env (void)
+void
+sanitize_env(void)
 {
 	char **envp = environ;
 	const char *const *bad;
@@ -225,9 +226,9 @@ void sanitize_env (void)
 			if (strncmp (*cur, *bad, strlen (*bad)) != 0) {
 				continue;
 			}
-			if (strchr (*cur, '/') == NULL) {
+			if (strchr(*cur, '/') == NULL)
 				continue;	/* OK */
-			}
+
 			for (move = cur; NULL != *move; move++) {
 				*move = *(move + 1);
 			}
diff --git a/lib/fields.c b/lib/fields.c
index 32399fe5d..b4aa868c8 100644
--- a/lib/fields.c
+++ b/lib/fields.c
@@ -67,7 +67,8 @@ int valid_field (const char *field, const char *illegal)
  * prompt the user with the name of the field being changed and the
  * current value.
  */
-void change_field (char *buf, size_t maxsize, const char *prompt)
+void
+change_field(char *buf, size_t maxsize, const char *prompt)
 {
 	char newf[200];
 	char *cp;
@@ -91,7 +92,7 @@ void change_field (char *buf, size_t maxsize, const char *prompt)
 		 * makes it possible to change the field to empty, by
 		 * entering a space.  --marekm
 		 */
-		stpcpy(strrspn(newf, " \t\n"), "");
+		stpcpy(strrspn(newf, " \t"), "");
 		cp = stpspn(newf, " \t");
 		strcpy (buf, cp);
 	}
diff --git a/lib/getrange.c b/lib/getrange.c
index 603152e68..e4382e6c9 100644
--- a/lib/getrange.c
+++ b/lib/getrange.c
@@ -9,6 +9,7 @@
 
 #include <ctype.h>
 #include <stdlib.h>
+#include <string.h>
 
 #include "atoi/a2i/a2u.h"
 #include "defines.h"
@@ -53,7 +54,7 @@ getrange(const char *range,
 		return 0;  /* <long> */
 
 	case '-':
-		if ('\0' == *end)
+		if (strcmp(end, "") == 0)
 			return 0;  /* <long>- */
 parse_max:
 		if (!isdigit((unsigned char) *end))
diff --git a/lib/limits.c b/lib/limits.c
index 74398bd82..399d747f1 100644
--- a/lib/limits.c
+++ b/lib/limits.c
@@ -19,6 +19,7 @@
 
 #ident "$Id$"
 
+#include <string.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ -341,7 +342,8 @@ static bool user_in_group (const char *uname, const char *gname)
 	return is_on_list (groupdata->gr_mem, uname);
 }
 
-static int setup_user_limits (const char *uname)
+static int
+setup_user_limits(const char *uname)
 {
 	FILE *fil;
 	char buf[1024];
@@ -412,11 +414,11 @@ static int setup_user_limits (const char *uname)
 		}
 	}
 	(void) fclose (fil);
-	if (limits[0] == '\0') {
+	if (strcmp(limits, "") == 0) {
 		/* no user specific limits */
-		if (deflimits[0] == '\0') {	/* no default limits */
+		if (strcmp(deflimits, "") == 0)  /* no defaults limits */
 			return 0;
-		}
+
 		strcpy (limits, deflimits);	/* use the default limits */
 	}
 	return do_user_limits (limits, uname);
diff --git a/lib/list.c b/lib/list.c
index 1132c5c7e..fcc9bf3a3 100644
--- a/lib/list.c
+++ b/lib/list.c
@@ -8,8 +8,7 @@
 
 #include <config.h>
 
-#ident "$Id$"
-
+#include <string.h>
 #include <assert.h>
 
 #include "alloc/x/xmalloc.h"
@@ -224,7 +223,7 @@ bool is_on_list (char *const *list, const char *member)
 	 * Empty list is special - 0 members, not 1 empty member.  --marekm
 	 */
 
-	if ('\0' == *members) {
+	if (strcmp(members, "") == 0) {
 		*array = NULL;
 		free (members);
 		return array;
diff --git a/lib/motd.c b/lib/motd.c
index 52712675f..6394dbd94 100644
--- a/lib/motd.c
+++ b/lib/motd.c
@@ -12,6 +12,7 @@
 #ident "$Id$"
 
 #include <stdio.h>
+#include <string.h>
 
 #include "defines.h"
 #include "getdef.h"
@@ -26,7 +27,8 @@
  * it to the user's terminal at login time.  The MOTD_FILE configuration
  * option is a colon-delimited list of filenames.
  */
-void motd (void)
+void
+motd(void)
 {
 	FILE *fp;
 	char *motdlist;
@@ -41,12 +43,8 @@ void motd (void)
 
 	motdlist = xstrdup (motdfile);
 
-	for (mb = motdlist; ;mb = NULL) {
-		motdfile = strtok (mb, ":");
-		if (NULL == motdfile) {
-			break;
-		}
-
+	mb = motdlist;
+	while (NULL != (motdfile = strsep(&mb, ":"))) {
 		fp = fopen (motdfile, "r");
 		if (NULL != fp) {
 			while ((c = getc (fp)) != EOF) {
diff --git a/lib/obscure.c b/lib/obscure.c
index 59babd4bc..15f492319 100644
--- a/lib/obscure.c
+++ b/lib/obscure.c
@@ -14,6 +14,7 @@
 
 #include <ctype.h>
 #include <stdio.h>
+#include <string.h>
 
 #include "attr.h"
 #include "prototypes.h"
@@ -50,7 +51,8 @@ static bool palindrome (MAYBE_UNUSED const char *old, const char *new)
  * more than half of the characters are different ones.
  */
 
-static bool similar (/*@notnull@*/const char *old, /*@notnull@*/const char *new)
+static bool
+similar(/*@notnull@*/const char *old, /*@notnull@*/const char *new)
 {
 	int i, j;
 
@@ -65,9 +67,8 @@ static bool similar (/*@notnull@*/const char *old, /*@notnull@*/const char *new)
 	}
 
 	for (i = j = 0; ('\0' != new[i]) && ('\0' != old[i]); i++) {
-		if (strchr (new, old[i]) != NULL) {
+		if (!!strchr(new, old[i]))
 			j++;
-		}
 	}
 
 	if (i >= j * 2) {
diff --git a/lib/port.c b/lib/port.c
index fe25fa9af..bfad37482 100644
--- a/lib/port.c
+++ b/lib/port.c
@@ -43,9 +43,9 @@ static int portcmp (const char *pattern, const char *port)
 		port++;
 	}
 
-	if (('\0' == *pattern) && ('\0' == *port)) {
+	if (strcmp(pattern, "") == 0 && strcmp(port, "") == 0)
 		return 0;
-	}
+
 	if (strcmp(orig, "SU") == 0)
 		return 1;
 
@@ -203,7 +203,7 @@ getportent(void)
 
 	cp = field;
 
-	if ('\0' == *cp) {
+	if (strcmp(field, "") == 0) {
 		port.pt_times = 0;
 		return &port;
 	}
@@ -214,7 +214,7 @@ getportent(void)
 	 * Get the next comma separated entry
 	 */
 
-	for (j = 0; ('\0' != *cp) && (j < PORT_TIMES); j++) {
+	for (j = 0; strcmp(cp, "") != 0 && (j < PORT_TIMES); j++) {
 
 		/*
 		 * Start off with no days of the week
diff --git a/lib/prefix_flag.c b/lib/prefix_flag.c
index 57d24332b..a226fc847 100644
--- a/lib/prefix_flag.c
+++ b/lib/prefix_flag.c
@@ -10,6 +10,7 @@
 #ident "$Id$"
 
 #include <stdio.h>
+#include <string.h>
 #include <assert.h>
 
 #include "atoi/getnum.h"
@@ -50,7 +51,8 @@ static FILE* fp_grent = NULL;
  *
  * The audit, syslog, or locale files shall be open before
  */
-extern const char* process_prefix_flag (const char* short_opt, int argc, char **argv)
+extern const char *
+process_prefix_flag(const char* short_opt, int argc, char **argv)
 {
 	/*
 	 * Parse the command line options.
@@ -96,7 +98,7 @@ extern const char* process_prefix_flag (const char* short_opt, int argc, char **
 			exit (EXIT_FAILURE);
 		}
 
-		if ( prefix[0] == '\0' || !strcmp(prefix, "/"))
+		if (strcmp(prefix, "") == 0 || strcmp(prefix, "/") == 0)
 			return ""; /* if prefix is "/" then we ignore the flag option */
 		/* should we prevent symbolic link from being used as a prefix? */
 
diff --git a/lib/pwauth.c b/lib/pwauth.c
index 0434dd08f..a29a61d5a 100644
--- a/lib/pwauth.c
+++ b/lib/pwauth.c
@@ -16,6 +16,7 @@
 #include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 #include <unistd.h>
 
@@ -47,10 +48,9 @@ static const char *PROMPT = gettext_noop ("%s's Password: ");
  *	compared.
  */
 
-int pw_auth (const char *cipher,
-             const char *user,
-             int reason,
-             /*@null@*/const char *input)
+int
+pw_auth(const char *cipher, const char *user, int reason,
+        /*@null@*/const char *input)
 {
 	int          retval;
 	char         prompt[1024];
@@ -101,10 +101,8 @@ int pw_auth (const char *cipher,
 	 * the user could just hit <ENTER>, so it doesn't really
 	 * matter.
 	 */
-
-	if ((NULL == cipher) || ('\0' == *cipher)) {
+	if (NULL == cipher || strcmp(cipher, "") == 0)
 		return 0;
-	}
 
 #ifdef	SKEY
 	/*
@@ -169,7 +167,7 @@ int pw_auth (const char *cipher,
 	 * ...Re-prompt, with echo on.
 	 * -- AR 8/22/1999
 	 */
-	if ((0 != retval) && ('\0' == input[0]) && use_skey) {
+	if (0 != retval && strcmp(input, "") == 0 && use_skey) {
 		erase_pass(clear);
 		clear = agetpass(prompt);
 		input = (clear == NULL) ? "" : clear;
diff --git a/lib/salt.c b/lib/salt.c
index efef4e59c..9644493ab 100644
--- a/lib/salt.c
+++ b/lib/salt.c
@@ -27,6 +27,7 @@
 #include "getdef.h"
 #include "shadowlog.h"
 
+
 #if (defined CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY && \
      CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY)
 #define USE_XCRYPT_GENSALT 1
@@ -354,7 +355,8 @@ static /*@observer@*/const char *gensalt (size_t salt_size)
  *    (if not NULL).
  *  * For the YESCRYPT method, this specifies the cost factor (if not NULL).
  */
-/*@observer@*/const char *crypt_make_salt (/*@null@*//*@observer@*/const char *meth, /*@null@*/void *arg)
+/*@observer@*/const char *
+crypt_make_salt(/*@null@*//*@observer@*/const char *meth, /*@null@*/void *arg)
 {
 	static char result[GENSALT_SETTING_SIZE];
 	size_t salt_len = MAX_SALT_SIZE;
@@ -417,7 +419,7 @@ static /*@observer@*/const char *gensalt (size_t salt_size)
 	 * Prepare DES setting for crypt_gensalt(), if result
 	 * has not been filled with anything previously.
 	 */
-	if ('\0' == result[0]) {
+	if (strcmp(result, "") == 0) {
 		/* Avoid -Wunused-but-set-variable. */
 		salt_len = GENSALT_SETTING_SIZE - 1;
 		rounds = 0;
diff --git a/lib/setupenv.c b/lib/setupenv.c
index f49c6adef..2e0b16362 100644
--- a/lib/setupenv.c
+++ b/lib/setupenv.c
@@ -16,10 +16,11 @@
 #ident "$Id$"
 
 #include <assert.h>
+#include <ctype.h>
+#include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <stdio.h>
-#include <ctype.h>
 
 #include "prototypes.h"
 #include "defines.h"
@@ -166,7 +167,8 @@ static void read_env_file (const char *filename)
  *	variables.
  */
 
-void setup_env (struct passwd *info)
+void
+setup_env(struct passwd *info)
 {
 #ifndef USE_PAM
 	const char *envf;
@@ -209,7 +211,7 @@ void setup_env (struct passwd *info)
 	 * Create the SHELL environmental variable and export it.
 	 */
 
-	if ((NULL == info->pw_shell) || ('\0' == *info->pw_shell)) {
+	if (NULL == info->pw_shell || strcmp(info->pw_shell, "") == 0) {
 		free (info->pw_shell);
 		info->pw_shell = xstrdup (SHELL);
 	}
@@ -233,7 +235,7 @@ void setup_env (struct passwd *info)
 	if (NULL == cp) {
 		/* not specified, use a minimal default */
 		addenv ((info->pw_uid == 0) ? "PATH=/sbin:/bin:/usr/sbin:/usr/bin" : "PATH=/bin:/usr/bin", NULL);
-	} else if (strchr (cp, '=')) {
+	} else if (!!strchr(cp, '=')) {
 		/* specified as name=value (PATH=...) */
 		addenv (cp, NULL);
 	} else {
diff --git a/lib/sgetgrent.c b/lib/sgetgrent.c
index b1202967e..dc01f766e 100644
--- a/lib/sgetgrent.c
+++ b/lib/sgetgrent.c
@@ -54,7 +54,7 @@ list(char *s)
 				return NULL;
 			}
 		}
-		if (!s || s[0] == '\0')
+		if (!s || strcmp(s, "") == 0)
 			break;
 		members[i++] = strsep(&s, ",");
 	}
@@ -63,7 +63,8 @@ list(char *s)
 }
 
 
-struct group *sgetgrent (const char *buf)
+struct group *
+sgetgrent(const char *buf)
 {
 	static char *grpbuf = NULL;
 	static size_t size = 0;
@@ -89,7 +90,7 @@ struct group *sgetgrent (const char *buf)
 	for (cp = grpbuf, i = 0; (i < NFIELDS) && (NULL != cp); i++)
 		grpfields[i] = strsep(&cp, ":");
 
-	if (i < (NFIELDS - 1) || *grpfields[2] == '\0' || cp != NULL) {
+	if (i < (NFIELDS - 1) || strcmp(grpfields[2], "") == 0 || cp != NULL) {
 		return NULL;
 	}
 	grent.gr_name = grpfields[0];
diff --git a/lib/sgetpwent.c b/lib/sgetpwent.c
index 20136695d..9205898b6 100644
--- a/lib/sgetpwent.c
+++ b/lib/sgetpwent.c
@@ -75,8 +75,11 @@ sgetpwent(const char *buf)
 	 * There must be exactly NFIELDS colon separated fields or
 	 * the entry is invalid.  Also, the UID and GID must be non-blank.
 	 */
-
-	if (i != NFIELDS || *fields[2] == '\0' || *fields[3] == '\0')
+	if (i != NFIELDS)
+		return NULL;
+	if (strcmp(fields[2], "") == 0)
+		return NULL;
+	if (strcmp(fields[3], "") == 0)
 		return NULL;
 
 	/*
diff --git a/lib/sgetspent.c b/lib/sgetspent.c
index 97f64edd5..00d375d58 100644
--- a/lib/sgetspent.c
+++ b/lib/sgetspent.c
@@ -85,7 +85,7 @@ sgetspent(const char *string)
 	 * incorrectly formatted number.
 	 */
 
-	if (fields[2][0] == '\0')
+	if (strcmp(fields[2], "") == 0)
 		spwd.sp_lstchg = -1;
 	else if (a2sl(&spwd.sp_lstchg, fields[2], NULL, 0, 0, LONG_MAX) == -1)
 		return NULL;
@@ -94,7 +94,7 @@ sgetspent(const char *string)
 	 * Get the minimum period between password changes.
 	 */
 
-	if (fields[3][0] == '\0')
+	if (strcmp(fields[3], "") == 0)
 		spwd.sp_min = -1;
 	else if (a2sl(&spwd.sp_min, fields[3], NULL, 0, 0, LONG_MAX) == -1)
 		return NULL;
@@ -103,7 +103,7 @@ sgetspent(const char *string)
 	 * Get the maximum number of days a password is valid.
 	 */
 
-	if (fields[4][0] == '\0')
+	if (strcmp(fields[4], "") == 0)
 		spwd.sp_max = -1;
 	else if (a2sl(&spwd.sp_max, fields[4], NULL, 0, 0, LONG_MAX) == -1)
 		return NULL;
@@ -126,7 +126,7 @@ sgetspent(const char *string)
 	 * Get the number of days of password expiry warning.
 	 */
 
-	if (fields[5][0] == '\0')
+	if (strcmp(fields[5], "") == 0)
 		spwd.sp_warn = -1;
 	else if (a2sl(&spwd.sp_warn, fields[5], NULL, 0, 0, LONG_MAX) == -1)
 		return NULL;
@@ -136,7 +136,7 @@ sgetspent(const char *string)
 	 * disabled.
 	 */
 
-	if (fields[6][0] == '\0')
+	if (strcmp(fields[6], "") == 0)
 		spwd.sp_inact = -1;
 	else if (a2sl(&spwd.sp_inact, fields[6], NULL, 0, 0, LONG_MAX) == -1)
 		return NULL;
@@ -146,7 +146,7 @@ sgetspent(const char *string)
 	 * set to expire.
 	 */
 
-	if (fields[7][0] == '\0')
+	if (strcmp(fields[7], "") == 0)
 		spwd.sp_expire = -1;
 	else if (a2sl(&spwd.sp_expire, fields[7], NULL, 0, 0, LONG_MAX) == -1)
 		return NULL;
@@ -156,7 +156,7 @@ sgetspent(const char *string)
 	 * to have anything other than a valid integer in it.
 	 */
 
-	if (fields[8][0] == '\0')
+	if (strcmp(fields[8], "") == 0)
 		spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
 	else if (str2ul(&spwd.sp_flag, fields[8]) == -1)
 		return NULL;
diff --git a/lib/shadow.c b/lib/shadow.c
index 8c08a8349..44436836e 100644
--- a/lib/shadow.c
+++ b/lib/shadow.c
@@ -61,7 +61,8 @@ void endspent (void)
  * my_sgetspent - convert string in shadow file format to (struct spwd *)
  */
 
-static struct spwd *my_sgetspent (const char *string)
+static struct spwd *
+my_sgetspent(const char *string)
 {
 	int                 i;
 	char                *fields[FIELDS];
@@ -110,7 +111,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * incorrectly formatted number, unless we are using NIS.
 	 */
 
-	if (fields[2][0] == '\0')
+	if (strcmp(fields[2], "") == 0)
 		spwd.sp_lstchg = -1;
 	else if (a2sl(&spwd.sp_lstchg, fields[2], NULL, 0, 0, LONG_MAX) == -1)
 		return 0;
@@ -119,7 +120,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * Get the minimum period between password changes.
 	 */
 
-	if (fields[3][0] == '\0')
+	if (strcmp(fields[3], "") == 0)
 		spwd.sp_min = -1;
 	else if (a2sl(&spwd.sp_min, fields[3], NULL, 0, 0, LONG_MAX) == -1)
 		return 0;
@@ -128,7 +129,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * Get the maximum number of days a password is valid.
 	 */
 
-	if (fields[4][0] == '\0')
+	if (strcmp(fields[4], "") == 0)
 		spwd.sp_max = -1;
 	else if (a2sl(&spwd.sp_max, fields[4], NULL, 0, 0, LONG_MAX) == -1)
 		return 0;
@@ -151,7 +152,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * Get the number of days of password expiry warning.
 	 */
 
-	if (fields[5][0] == '\0')
+	if (strcmp(fields[5], "") == 0)
 		spwd.sp_warn = -1;
 	else if (a2sl(&spwd.sp_warn, fields[5], NULL, 0, 0, LONG_MAX) == -1)
 		return 0;
@@ -161,7 +162,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * disabled.
 	 */
 
-	if (fields[6][0] == '\0')
+	if (strcmp(fields[6], "") == 0)
 		spwd.sp_inact = -1;
 	else if (a2sl(&spwd.sp_inact, fields[6], NULL, 0, 0, LONG_MAX) == -1)
 		return 0;
@@ -171,7 +172,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * set to expire.
 	 */
 
-	if (fields[7][0] == '\0')
+	if (strcmp(fields[7], "") == 0)
 		spwd.sp_expire = -1;
 	else if (a2sl(&spwd.sp_expire, fields[7], NULL, 0, 0, LONG_MAX) == -1)
 		return 0;
@@ -181,7 +182,7 @@ static struct spwd *my_sgetspent (const char *string)
 	 * to have anything other than a valid integer in it.
 	 */
 
-	if (fields[8][0] == '\0')
+	if (strcmp(fields[8], "") == 0)
 		spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
 	else if (str2ul(&spwd.sp_flag, fields[8]) == -1)
 		return 0;
diff --git a/lib/sssd.c b/lib/sssd.c
index 09f539f46..9889fa89f 100644
--- a/lib/sssd.c
+++ b/lib/sssd.c
@@ -46,7 +46,7 @@ sssd_flush_cache(int dbflags)
 	if (dbflags & SSSD_DB_GROUP)
 		stpcpy(p, "G");
 
-	if (*p == '\0') {
+	if (strcmp(p, "") == 0) {
 		/* Neither passwd nor group, nothing to do */
 		free(sss_cache_args);
 		return 0;
diff --git a/lib/strtoday.c b/lib/strtoday.c
index db0866097..88b4546bf 100644
--- a/lib/strtoday.c
+++ b/lib/strtoday.c
@@ -10,8 +10,7 @@
 #include <config.h>
 
 #include <ctype.h>
-
-#ident "$Id$"
+#include <string.h>
 
 #include "atoi/str2i/str2s.h"
 #include "getdate.h"
@@ -33,7 +32,8 @@
  *	24-sep-72
  *	24sep72
  */
-long strtoday (const char *str)
+long
+strtoday(const char *str)
 {
 	time_t t;
 	bool isnum = true;
@@ -44,9 +44,8 @@ long strtoday (const char *str)
 	 * which is not what we expect, unless you're a BOFH :-).
 	 * (useradd sets sp_expire = current date for new lusers)
 	 */
-	if ((NULL == str) || ('\0' == *str)) {
+	if (NULL == str || strcmp(str, "") == 0)
 		return -1;
-	}
 
 	/* If a numerical value is provided, this is already a number of
 	 * days since EPOCH.
diff --git a/lib/subordinateio.c b/lib/subordinateio.c
index 295df2bd4..38a33d67b 100644
--- a/lib/subordinateio.c
+++ b/lib/subordinateio.c
@@ -107,7 +107,13 @@ subordinate_parse(const char *line)
 	 * There must be exactly SUBID_NFIELDS colon separated fields or
 	 * the entry is invalid.  Also, fields must be non-blank.
 	 */
-	if (i != SUBID_NFIELDS || *fields[0] == '\0' || *fields[1] == '\0' || *fields[2] == '\0')
+	if (i != SUBID_NFIELDS)
+		return NULL;
+	if (strcmp(fields[0], "") == 0)
+		return NULL;
+	if (strcmp(fields[1], "") == 0)
+		return NULL;
+	if (strcmp(fields[2], "") == 0)
 		return NULL;
 	range.owner = fields[0];
 	if (str2ul(&range.start, fields[1]) == -1)
diff --git a/lib/tcbfuncs.c b/lib/tcbfuncs.c
index 3dc2abd70..34844b7b2 100644
--- a/lib/tcbfuncs.c
+++ b/lib/tcbfuncs.c
@@ -184,7 +184,8 @@ static /*@null@*/ char *shadowtcb_path_existing (const char *name)
 	return ret;
 }
 
-static shadowtcb_status mkdir_leading (const char *name, uid_t uid)
+static shadowtcb_status
+mkdir_leading(const char *name, uid_t uid)
 {
 	char *ind, *dir, *ptr, *path = shadowtcb_path_rel (name, uid);
 	struct stat st;
@@ -199,7 +200,7 @@ static shadowtcb_status mkdir_leading (const char *name, uid_t uid)
 		         shadow_progname, TCB_DIR, strerror (errno));
 		goto out_free_path;
 	}
-	while ((ind = strchr (ptr, '/'))) {
+	while (NULL != (ind = strchr(ptr, '/'))) {
 		stpcpy(ind, "");
 		if (asprintf (&dir, TCB_DIR "/%s", path) == -1) {
 			OUT_OF_MEMORY;
diff --git a/lib/utmp.c b/lib/utmp.c
index 4e10eb986..de1e2006f 100644
--- a/lib/utmp.c
+++ b/lib/utmp.c
@@ -52,13 +52,13 @@ is_my_tty(const char tty[UTX_LINESIZE])
 		strcpy (full_tty, "/dev/");
 	strncat(full_tty, tty, UTX_LINESIZE);
 
-	if ('\0' == tmptty[0]) {
+	if (strcmp(tmptty, "") == 0) {
 		const char *tname = ttyname (STDIN_FILENO);
 		if (NULL != tname)
 			STRTCPY(tmptty, tname);
 	}
 
-	if ('\0' == tmptty[0]) {
+	if (strcmp(tmptty, "") == 0) {
 		(void) puts (_("Unable to determine your tty name."));
 		exit (EXIT_FAILURE);
 	}
@@ -411,12 +411,12 @@ active_sessions_count(const char *name, unsigned long limit)
 		if (USER_PROCESS != ut->ut_type) {
 			continue;
 		}
-		if ('\0' == ut->ut_user[0]) {
+		if (strncmp(ut->ut_user, "", NITEMS(ut->ut_user)) == 0)
 			continue;
-		}
-		if (strncmp (name, ut->ut_user, sizeof (ut->ut_user)) != 0) {
+
+		if (strncmp(ut->ut_user, name, NITEMS(ut->ut_user)) != 0)
 			continue;
-		}
+
 		count++;
 		if (count > limit) {
 			break;
diff --git a/lib/valid.c b/lib/valid.c
index 326635ffc..3d1e36b68 100644
--- a/lib/valid.c
+++ b/lib/valid.c
@@ -9,13 +9,15 @@
 
 #include <config.h>
 
-#ident "$Id$"
-
+#include <pwd.h>
 #include <sys/types.h>
 #include <stdio.h>
+#include <string.h>
+
 #include "prototypes.h"
 #include "defines.h"
-#include <pwd.h>
+
+
 /*
  * valid - compare encrypted passwords
  *
@@ -26,7 +28,8 @@
  *	is used to indicate that a dummy salt must be used to encrypt the
  *	password anyway.
  */
-bool valid (const char *password, const struct passwd *ent)
+bool
+valid(const char *password, const struct passwd *ent)
 {
 	const char *encrypted;
 	/*@observer@*/const char *salt;
@@ -37,24 +40,20 @@ bool valid (const char *password, const struct passwd *ent)
 	 * the password is really empty do you return quickly.  This
 	 * routine is meant to waste CPU time.
 	 */
-
-	if ((NULL != ent->pw_name) && ('\0' == ent->pw_passwd[0])) {
-		if ('\0' == password[0]) {
+	if (NULL != ent->pw_name && strcmp(ent->pw_passwd, "") == 0) {
+		if (strcmp(password, "") == 0)
 			return true;	/* user entered nothing */
-		} else {
+		else
 			return false;	/* user entered something! */
-		}
 	}
 
 	/*
 	 * If there is no entry then we need a salt to use.
 	 */
-
-	if ((NULL == ent->pw_name) || ('\0' == ent->pw_passwd[0])) {
+	if (NULL == ent->pw_name || strcmp(ent->pw_passwd, "") == 0)
 		salt = "xx";
-	} else {
+	else
 		salt = ent->pw_passwd;
-	}
 
 	/*
 	 * Now, perform the encryption using the salt from before on
diff --git a/src/chfn.c b/src/chfn.c
index 1872b2df4..0a837fbe3 100644
--- a/src/chfn.c
+++ b/src/chfn.c
@@ -15,6 +15,7 @@
 #include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 #include <getopt.h>
 
@@ -122,7 +123,8 @@ usage (int status)
  *
  *	Return true if the user can change the field and false otherwise.
  */
-static bool may_change_field (int field)
+static bool
+may_change_field(int field)
 {
 	const char *cp;
 
@@ -156,9 +158,8 @@ static bool may_change_field (int field)
 		cp = "frwh";
 	}
 
-	if (strchr (cp, field) != NULL) {
+	if (!!strchr(cp, field))
 		return true;
-	}
 
 	return false;
 }
diff --git a/src/chpasswd.c b/src/chpasswd.c
index 55817ddf4..6bbcbac9e 100644
--- a/src/chpasswd.c
+++ b/src/chpasswd.c
@@ -16,6 +16,7 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 
 #ifdef USE_PAM
 #include "pam_defs.h"
@@ -439,12 +440,12 @@ static const char *get_salt(void)
 	return crypt_make_salt (crypt_method, arg);
 }
 
-int main (int argc, char **argv)
+int
+main(int argc, char **argv)
 {
 	char buf[BUFSIZ];
 	char *name;
 	char *newpwd;
-	char *cp;
 	const char *salt;
 
 #ifdef USE_PAM
@@ -501,15 +502,15 @@ int main (int argc, char **argv)
 	 * present.
 	 */
 	while (fgets (buf, sizeof buf, stdin) != NULL) {
+		char  *cp;
+
 		line++;
 		if (stpsep(buf, "\n") == NULL) {
 			if (feof (stdin) == 0) {
 				// Drop all remaining characters on this line.
 				while (fgets (buf, sizeof buf, stdin) != NULL) {
-					cp = strchr (buf, '\n');
-					if (cp != NULL) {
+					if (!!strchr(buf, '\n'))
 						break;
-					}
 				}
 
 				fprintf (stderr,
diff --git a/src/groupadd.c b/src/groupadd.c
index 1623ba804..b58fc3efd 100644
--- a/src/groupadd.c
+++ b/src/groupadd.c
@@ -16,6 +16,7 @@
 #include <getopt.h>
 #include <grp.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
@@ -164,7 +165,8 @@ static void new_sgent (struct sgrp *sgent)
  *
  *	grp_update() writes the new records to the group files.
  */
-static void grp_update (void)
+static void
+grp_update(void)
 {
 	struct group grp;
 
@@ -196,15 +198,15 @@ static void grp_update (void)
 #endif				/* SHADOWGRP */
 
 	if (user_list) {
-		char *token;
-		token = strtok(user_list, ",");
-		while (token) {
-			if (prefix_getpwnam (token) == NULL) {
-				fprintf (stderr, _("Invalid member username %s\n"), token);
+		char  *u, *ul;
+
+		ul = user_list;
+		while (NULL != (u = strsep(&ul, ","))) {
+			if (prefix_getpwnam(u) == NULL) {
+				fprintf(stderr, _("Invalid member username %s\n"), u);
 				exit (E_GRP_UPDATE);
 			}
-			grp.gr_mem = add_list(grp.gr_mem, token);
-			token = strtok(NULL, ",");
+			grp.gr_mem = add_list(grp.gr_mem, u);
 		}
 	}
 
diff --git a/src/groupmod.c b/src/groupmod.c
index 0c0e29a60..5173c5a8d 100644
--- a/src/groupmod.c
+++ b/src/groupmod.c
@@ -17,6 +17,7 @@
 #include <grp.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <string.h>
 #include <strings.h>
 #include <sys/types.h>
 #ifdef ACCT_TOOLS_SETUID
@@ -197,7 +198,8 @@ static void new_sgent (struct sgrp *sgent)
  *
  *	grp_update() updates the new records in the memory databases.
  */
-static void grp_update (void)
+static void
+grp_update(void)
 {
 	struct group grp;
 	const struct group *ogrp;
@@ -250,7 +252,7 @@ static void grp_update (void)
 	}
 
 	if (user_list) {
-		char *token;
+		char  *u, *ul;
 
 		if (!aflg) {
 			// requested to replace the existing groups
@@ -262,14 +264,13 @@ static void grp_update (void)
 				grp.gr_mem = dup_list (grp.gr_mem);
 		}
 
-		token = strtok(user_list, ",");
-		while (token) {
-			if (prefix_getpwnam (token) == NULL) {
-				fprintf (stderr, _("Invalid member username %s\n"), token);
+		ul = user_list;
+		while (NULL != (u = strsep(&ul, ","))) {
+			if (prefix_getpwnam(u) == NULL) {
+				fprintf(stderr, _("Invalid member username %s\n"), u);
 				exit (E_GRP_UPDATE);
 			}
-			grp.gr_mem = add_list(grp.gr_mem, token);
-			token = strtok(NULL, ",");
+			grp.gr_mem = add_list(grp.gr_mem, u);
 		}
 	}
 
diff --git a/src/grpck.c b/src/grpck.c
index 4ef1b1542..c91a8a440 100644
--- a/src/grpck.c
+++ b/src/grpck.c
@@ -578,7 +578,8 @@ static void check_grp_file (int *errors, bool *changed)
 		 */
 		if (   (NULL != grp->gr_mem[0])
 		    && (NULL == grp->gr_mem[1])
-		    && ('\0' == grp->gr_mem[0][0])) {
+		    && strcmp(grp->gr_mem[0], "") == 0)
+		{
 			grp->gr_mem[0] = NULL;
 		}
 
diff --git a/src/login.c b/src/login.c
index 2319f50b3..cba334d05 100644
--- a/src/login.c
+++ b/src/login.c
@@ -660,7 +660,7 @@ int main (int argc, char **argv)
 		/* if we didn't get a user on the command line,
 		   set it to NULL */
 		get_pam_user (&pam_user);
-		if ((NULL != pam_user) && ('\0' == pam_user[0])) {
+		if (NULL != pam_user && strcmp(pam_user, "") == 0) {
 			retcode = pam_set_item (pamh, PAM_USER, NULL);
 			PAM_FAIL_CHECK;
 		}
@@ -837,7 +837,7 @@ int main (int argc, char **argv)
 			username = XMALLOC(max_size, char);
 			login_prompt(username, max_size);
 
-			if ('\0' == username[0]) {
+			if (strcmp(username, "") == 0) {
 				/* Prompt for a new login */
 				free (username);
 				username = NULL;
@@ -962,9 +962,8 @@ int main (int argc, char **argv)
 		 * guys won't see that the passwordless account exists at
 		 * all).  --marekm
 		 */
-		if (user_passwd[0] == '\0') {
+		if (strcmp(user_passwd, "") == 0)
 			pw_auth ("!", username, reason, NULL);
-		}
 
 		/*
 		 * Authentication of this user failed.
diff --git a/src/login_nopam.c b/src/login_nopam.c
index 5c0ecc0e8..f5a7f9654 100644
--- a/src/login_nopam.c
+++ b/src/login_nopam.c
@@ -71,10 +71,6 @@
 #define TABLE	"/etc/login.access"
 #endif
 
-/* Delimiters for fields and for lists of users, ttys or hosts. */
-static char fs[] = ":";		/* field separator */
-static char sep[] = ", \t";	/* list-element separator */
-
 static bool list_match (char *list, const char *item, bool (*match_fn) (const char *, const char *));
 static bool user_match (const char *tok, const char *string);
 static bool from_match (const char *tok, const char *string);
@@ -82,7 +78,8 @@ static bool string_match (const char *tok, const char *string);
 static const char *resolve_hostname (const char *string);
 
 /* login_access - match username/group and host/tty with access control file */
-int login_access (const char *user, const char *from)
+int
+login_access(const char *user, const char *from)
 {
 	FILE *fp;
 	char line[BUFSIZ];
@@ -102,7 +99,10 @@ int login_access (const char *user, const char *from)
 	if (NULL != fp) {
 		int lineno = 0;	/* for diagnostics */
 		while (   !match
-		       && (fgets (line, sizeof (line), fp) == line)) {
+		       && (fgets (line, sizeof (line), fp) == line))
+		{
+			char  *p;
+
 			lineno++;
 			if (stpsep(line, "\n") == NULL) {
 				SYSLOG ((LOG_ERR,
@@ -114,13 +114,14 @@ int login_access (const char *user, const char *from)
 				continue;	/* comment line */
 			}
 			stpcpy(strrspn(line, " \t"), "");
-			if (line[0] == '\0') {	/* skip blank lines */
+			if (strcmp(line, "") == 0)  /* skip blank lines */
 				continue;
-			}
-			if (   ((perm = strtok (line, fs)) == NULL)
-			    || ((users = strtok (NULL, fs)) == NULL)
-			    || ((froms = strtok (NULL, fs)) == NULL)
-			    || (strtok (NULL, fs) != NULL)) {
+
+			p = line;
+			perm = strsep(&p, ":");
+			users = strsep(&p, ":");
+			froms = strsep(&p, ":");
+			if (froms == NULL || p != NULL) {
 				SYSLOG ((LOG_ERR,
 					 "%s: line %d: bad field count",
 					 TABLE, lineno));
@@ -144,7 +145,8 @@ int login_access (const char *user, const char *from)
 }
 
 /* list_match - match an item against a list of tokens with exceptions */
-static bool list_match (char *list, const char *item, bool (*match_fn) (const char *, const char*))
+static bool
+list_match(char *list, const char *item, bool (*match_fn)(const char *, const char*))
 {
 	char *tok;
 	bool match = false;
@@ -155,7 +157,7 @@ static bool list_match (char *list, const char *item, bool (*match_fn) (const ch
 	 * a match, look for an "EXCEPT" list and recurse to determine whether
 	 * the match is affected by any exceptions.
 	 */
-	for (tok = strtok (list, sep); tok != NULL; tok = strtok (NULL, sep)) {
+	while (NULL != (tok = strsep(&list, ", \t"))) {
 		if (strcasecmp (tok, "EXCEPT") == 0) {	/* EXCEPT: give up */
 			break;
 		}
@@ -167,7 +169,7 @@ static bool list_match (char *list, const char *item, bool (*match_fn) (const ch
 
 	/* Process exceptions to matches. */
 	if (match) {
-		while (   ((tok = strtok (NULL, sep)) != NULL)
+		while (   (NULL != (tok = strsep(&list, ", \t")))
 		       && (strcasecmp (tok, "EXCEPT") != 0))
 			/* VOID */ ;
 		if (tok == 0 || !list_match (NULL, item, match_fn)) {
@@ -178,11 +180,12 @@ static bool list_match (char *list, const char *item, bool (*match_fn) (const ch
 }
 
 /* myhostname - figure out local machine name */
-static char *myhostname (void)
+static char *
+myhostname(void)
 {
 	static char name[MAXHOSTNAMELEN + 1] = "";
 
-	if (name[0] == '\0') {
+	if (strcmp(name, "") == 0) {
 		gethostname (name, sizeof (name));
 		stpcpy(&name[MAXHOSTNAMELEN], "");
 	}
@@ -288,7 +291,8 @@ static const char *resolve_hostname (const char *string)
 
 /* from_match - match a host or tty against a list of tokens */
 
-static bool from_match (const char *tok, const char *string)
+static bool
+from_match(const char *tok, const char *string)
 {
 	size_t tok_len;
 
@@ -316,10 +320,11 @@ static bool from_match (const char *tok, const char *string)
 			return true;
 		}
 	} else if (strcasecmp (tok, "LOCAL") == 0) {	/* local: no dots */
-		if (strchr (string, '.') == NULL) {
+		if (strchr(string, '.') == NULL)
 			return true;
-		}
-	} else if (   (tok[0] != '\0' && tok[(tok_len = strlen (tok)) - 1] == '.') /* network */
+
+	} else if (   (strcmp(tok, "") != 0)
+		   && (tok[(tok_len = strlen (tok)) - 1] == '.') /* network */
 		   && (strncmp (tok, resolve_hostname (string), tok_len) == 0)) {
 		return true;
 	}
diff --git a/src/logoutd.c b/src/logoutd.c
index 11a5d60a3..72d9387b1 100644
--- a/src/logoutd.c
+++ b/src/logoutd.c
@@ -13,6 +13,7 @@
 #include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <utmpx.h>
@@ -178,9 +179,9 @@ main(int argc, char **argv)
 			if (ut->ut_type != USER_PROCESS) {
 				continue;
 			}
-			if (ut->ut_user[0] == '\0') {
+			if (strncmp(ut->ut_user, "", NITEMS(ut->ut_user)) == 0)
 				continue;
-			}
+
 			if (check_login (ut)) {
 				continue;
 			}
diff --git a/src/newgrp.c b/src/newgrp.c
index 11fc6f82a..666d988da 100644
--- a/src/newgrp.c
+++ b/src/newgrp.c
@@ -15,6 +15,7 @@
 #include <grp.h>
 #include <pwd.h>
 #include <stdio.h>
+#include <string.h>
 #include <assert.h>
 
 #include "agetpass.h"
@@ -114,9 +115,8 @@ static /*@null@*/struct group *find_matching_group (const char *name, struct gro
  *
  *	It will not return if the user could not be authenticated.
  */
-static void check_perms (const struct group *grp,
-                         struct passwd *pwd,
-                         const char *groupname)
+static void
+check_perms(const struct group *grp, struct passwd *pwd, const char *groupname)
 {
 	bool needspasswd = false;
 	struct spwd *spwd;
@@ -148,9 +148,8 @@ static void check_perms (const struct group *grp,
 		spw_free (spwd);
 	}
 
-	if ((pwd->pw_passwd[0] == '\0') && (grp->gr_passwd[0] != '\0')) {
+	if (strcmp(pwd->pw_passwd, "") == 0 && strcmp(grp->gr_passwd, "") != 0)
 		needspasswd = true;
-	}
 
 	/*
 	 * Now I see about letting her into the group she requested. If she
@@ -186,8 +185,9 @@ static void check_perms (const struct group *grp,
 			goto failure;
 		}
 
-		if (grp->gr_passwd[0] == '\0' ||
-		    strcmp (cpasswd, grp->gr_passwd) != 0) {
+		if (strcmp(grp->gr_passwd, "") == 0 ||
+		    strcmp(grp->gr_passwd, cpasswd) != 0)
+		{
 #ifdef WITH_AUDIT
 			SNPRINTF(audit_buf, "authentication new-gid=%lu",
 			         (unsigned long) grp->gr_gid);
diff --git a/src/su.c b/src/su.c
index 40e8189f9..126dc0a8e 100644
--- a/src/su.c
+++ b/src/su.c
@@ -37,6 +37,7 @@
 #include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/types.h>
 #include <unistd.h>
 #ifndef USE_PAM
@@ -813,7 +814,8 @@ save_caller_context(void)
  *	the values that the user will be created with accordingly. The
  *	values are checked for sanity.
  */
-static void process_flags (int argc, char **argv)
+static void
+process_flags(int argc, char **argv)
 {
 	int c;
 	static struct option long_options[] = {
@@ -861,7 +863,7 @@ static void process_flags (int argc, char **argv)
 	if (optind < argc) {
 		STRTCPY(name, argv[optind++]);	/* use this login id */
 	}
-	if ('\0' == name[0]) {		/* use default user */
+	if (strcmp(name, "") == 0) {		/* use default user */
 		struct passwd *root_pw = getpwnam ("root");
 		if ((NULL != root_pw) && (0 == root_pw->pw_uid)) {
 			(void) strcpy (name, "root");
@@ -881,7 +883,8 @@ static void process_flags (int argc, char **argv)
 	}
 }
 
-static void set_environment (struct passwd *pw)
+static void
+set_environment(struct passwd *pw)
 {
 	const char *cp;
 	/*
@@ -949,7 +952,7 @@ static void set_environment (struct passwd *pw)
 	cp = getdef_str ((pw->pw_uid == 0) ? "ENV_SUPATH" : "ENV_PATH");
 	if (NULL == cp) {
 		addenv ((pw->pw_uid == 0) ? "PATH=/sbin:/bin:/usr/sbin:/usr/bin" : "PATH=/bin:/usr/bin", NULL);
-	} else if (strchr (cp, '=') != NULL) {
+	} else if (!!strchr(cp, '=')) {
 		addenv (cp, NULL);
 	} else {
 		addenv ("PATH", cp);
@@ -1003,7 +1006,8 @@ static void set_environment (struct passwd *pw)
  *	particular, the argument "-c" will cause the next argument to be
  *	interpreted as a command by the common shell programs.
  */
-int main (int argc, char **argv)
+int
+main(int argc, char **argv)
 {
 	const char *cp;
 	struct passwd *pw = NULL;
@@ -1076,12 +1080,9 @@ int main (int argc, char **argv)
 		shellstr = pw->pw_shell;
 	}
 
-	/*
-	 * Set the default shell.
-	 */
-	if ((NULL == shellstr) || ('\0' == shellstr[0])) {
+	/* Set the default shell.  */
+	if (NULL == shellstr || strcmp(shellstr, "") == 0)
 		shellstr = SHELL;
-	}
 
 	sulog (caller_tty, true, caller_name, name);	/* save SU information */
 	if (getdef_bool ("SYSLOG_SU_ENAB")) {
diff --git a/src/suauth.c b/src/suauth.c
index cbb33dc8d..4d9df2004 100644
--- a/src/suauth.c
+++ b/src/suauth.c
@@ -44,11 +44,9 @@ static int isgrp (const char *, const char *);
 static int lines = 0;
 
 
-int check_su_auth (const char *actual_id,
-                   const char *wanted_id,
-                   bool su_to_root)
+int
+check_su_auth(const char *actual_id, const char *wanted_id, bool su_to_root)
 {
-	const char field[] = ":";
 	FILE *authfile_fd;
 	char temp[1024];
 	char *to_users;
@@ -90,10 +88,10 @@ int check_su_auth (const char *actual_id,
 		if (*p == '#' || *p == '\0')
 			continue;
 
-		if (!(to_users = strtok(p, field))
-		    || !(from_users = strtok (NULL, field))
-		    || !(action = strtok (NULL, field))
-		    || strtok (NULL, field)) {
+		to_users = strsep(&p, ":");
+		from_users = strsep(&p, ":");
+		action = strsep(&p, ":");
+		if (action == NULL || p != NULL) {
 			SYSLOG ((LOG_ERR,
 				 "%s, line %d. Bad number of fields.\n",
 				 SUAUTHFILE, lines));
@@ -137,15 +135,14 @@ int check_su_auth (const char *actual_id,
 	return NOACTION;
 }
 
-static int applies (const char *single, char *list)
+static int
+applies(const char *single, char *list)
 {
-	const char split[] = ", ";
 	char *tok;
 
 	int state = 0;
 
-	for (tok = strtok (list, split); tok != NULL;
-	     tok = strtok (NULL, split)) {
+	while (NULL != (tok = strsep(&list, ", "))) {
 
 		if (!strcmp (tok, "ALL")) {
 			if (state != 0) {
diff --git a/src/sulogin.c b/src/sulogin.c
index 6af471b59..c1fc40cf8 100644
--- a/src/sulogin.c
+++ b/src/sulogin.c
@@ -15,6 +15,7 @@
 #include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
 
@@ -153,7 +154,7 @@ main(int argc, char *argv[])
 		 * it will work with standard getpass() (no NULL on EOF).
 		 * --marekm
 		 */
-		if ((NULL == pass) || ('\0' == *pass)) {
+		if (NULL == pass || strcmp(pass, "") == 0) {
 			erase_pass (pass);
 			(void) puts ("");
 #ifdef	TELINIT
diff --git a/src/useradd.c b/src/useradd.c
index 64e7a412e..5f85b719e 100644
--- a/src/useradd.c
+++ b/src/useradd.c
@@ -438,7 +438,7 @@ get_defaults(void)
 		 * Default Skeleton information
 		 */
 		else if (strcmp(buf, DSKEL) == 0) {
-			if ('\0' == *ccp)
+			if (strcmp(ccp, "") == 0)
 				ccp = SKEL_DIR;
 
 			if (prefix[0]) {
@@ -455,7 +455,7 @@ get_defaults(void)
 		 * Default Usr Skeleton information
 		 */
 		else if (strcmp(buf, DUSRSKEL) == 0) {
-			if ('\0' == *ccp)
+			if (strcmp(ccp, "") == 0)
 				ccp = USRSKELDIR;
 
 			if (prefix[0]) {
@@ -471,7 +471,7 @@ get_defaults(void)
 		 * Create by default user mail spool or not ?
 		 */
 		else if (strcmp(buf, DCREATE_MAIL_SPOOL) == 0) {
-			if (*ccp == '\0')
+			if (strcmp(ccp, "") == 0)
 				ccp = "no";
 
 			def_create_mail_spool = xstrdup(ccp);
@@ -481,7 +481,7 @@ get_defaults(void)
 		 * By default do we add the user to the lastlog and faillog databases ?
 		 */
 		else if (strcmp(buf, DLOG_INIT) == 0) {
-			if (*ccp == '\0')
+			if (strcmp(ccp, "") == 0)
 				ccp = def_log_init;
 
 			def_log_init = xstrdup(ccp);
@@ -754,15 +754,15 @@ set_defaults(void)
  *	converts it to a NULL-terminated array. Any unknown group
  *	names are reported as errors.
  */
-static int get_groups (char *list)
+static int
+get_groups(char *list)
 {
 	struct group *grp;
 	int errors = 0;
 	int ngroups = 0;
 
-	if ('\0' == *list) {
+	if (strcmp(list, "") == 0)
 		return 0;
-	}
 
 	/*
 	 * Open the group files
diff --git a/src/userdel.c b/src/userdel.c
index ead696041..4ccc3f520 100644
--- a/src/userdel.c
+++ b/src/userdel.c
@@ -16,6 +16,7 @@
 #include <grp.h>
 #include <pwd.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
@@ -948,7 +949,8 @@ static int remove_tcbdir (const char *user_name, uid_t user_id)
 /*
  * main - userdel command
  */
-int main (int argc, char **argv)
+int
+main(int argc, char **argv)
 {
 	int errors = 0; /* Error in the removal of the home directory */
 
@@ -1130,8 +1132,8 @@ int main (int argc, char **argv)
 	 * Note: This is a best effort basis. The user may log in between,
 	 * a cron job may be started on her behalf, etc.
 	 */
-	if ((prefix[0] == '\0') && !Rflg && user_busy (user_name, user_id) != 0) {
-		if (!fflg) {
+	if (strcmp(prefix, "") == 0 && !Rflg) {
+		if (user_busy (user_name, user_id) != 0 && !fflg) {
 #ifdef WITH_AUDIT
 			audit_logger (AUDIT_DEL_USER, Prog,
 			              "deleting user logged in",
@@ -1263,7 +1265,7 @@ int main (int argc, char **argv)
 	 * Cancel any crontabs or at jobs. Have to do this before we remove
 	 * the entry from /etc/passwd.
 	 */
-	if (prefix[0] == '\0')
+	if (strcmp(prefix, "") == 0)
 		user_cancel (user_name);
 	close_files ();
 
diff --git a/src/usermod.c b/src/usermod.c
index e994132c8..aa69eac64 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -27,6 +27,7 @@
 #endif				/* USE_PAM */
 #endif				/* ACCT_TOOLS_SETUID */
 #include <stdio.h>
+#include <string.h>
 #include <strings.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -215,7 +216,8 @@ extern int allow_bad_names;
  *	converts it to a NULL-terminated array. Any unknown group names are
  *	reported as errors.
  */
-static int get_groups (char *list)
+static int
+get_groups(char *list)
 {
 	struct group *grp;
 	int errors = 0;
@@ -226,9 +228,8 @@ static int get_groups (char *list)
 	 */
 	user_groups[0] = NULL;
 
-	if ('\0' == *list) {
+	if (strcmp(list, "") == 0)
 		return 0;
-	}
 
 	/*
 	 * So long as there is some data to be converted, strip off each
@@ -2141,7 +2142,8 @@ static void move_mailbox (void)
 /*
  * main - usermod command
  */
-int main (int argc, char **argv)
+int
+main(int argc, char **argv)
 {
 #ifdef ACCT_TOOLS_SETUID
 #ifdef USE_PAM
@@ -2185,7 +2187,7 @@ int main (int argc, char **argv)
 	 * be changed while the user is logged in.
 	 * Note: no need to check if a prefix is specified...
 	 */
-	if ( (prefix[0] == '\0') &&  (uflg || lflg || dflg
+	if ( strcmp(prefix, "") == 0 &&  (uflg || lflg || dflg
 #ifdef ENABLE_SUBIDS
 	        || Vflg || Wflg
 #endif				/* ENABLE_SUBIDS */