function get_posts($args) {
	global $wpdb;
	parse_str($args, $r);
	if ( !isset($r['numberposts']) )
		$r['numberposts'] = 5;
	if ( !isset($r['offset']) )
		$r['offset'] = 0;
	if ( !isset($r['category']) )
		$r['category'] = '';
	if ( !isset($r['orderby']) )
		$r['orderby'] = 'post_date';
	if ( !isset($r['order']) )
		$r['order'] = 'DESC';
 
	$now = current_time('mysql');
 
	$posts = $wpdb->get_results(
		"SELECT DISTINCT * FROM $wpdb->posts " .
		( empty( $r['category'] ) ? "" : ", $wpdb->post2cat " ) .
		" WHERE post_date <= '$now' AND (post_status = 'publish') ".
		( empty( $r['category'] ) ? "" : "AND $wpdb->posts.ID = $wpdb->post2cat.post_id AND $wpdb->post2cat.category_id = " . $r['category']. " " ) .
		" GROUP BY $wpdb->posts.ID ORDER BY " . $r['orderby'] . " " . $r['order'] . " LIMIT " . $r['offset'] . ',' . $r['numberposts'] );
 
	update_post_caches($posts);
 
	return $posts;
}
 

Sorry about that; my mind was kind of mush last night. It's in functions.php, as you've found.

I'm not a PHP expert, but I'm wondering if there's some condition where the variable is set to null, or an empty string or something, so it passes the isset() test, but doesn't show up in the string.

What say the PHP experts?

Without seeing how the function arguments are handled it's hard to say for sure.

But, if that is the only test they're performing on the data then they need to add more. At the moment a variable could be an empty string and it would pass their basic checks.