When using `qs.stringify` with the `allowEmptyArrays` option set to `true`, the software fails to encode the keys of empty arrays. This occurs because the `allowEmptyArrays` branch in `lib/stringify.js` returns the key early, bypassing the `encoder` and `formatter` functions. If a caller-supplied key contains special characters such as `&` (or a custom delimiter), `=`, or `#`, these characters are treated as query string syntax rather than data. This allows an attacker to inject additional parameters into the serialized query string or prematurely terminate the string using a `#` character, which converts the remainder of the URL into a fragment. This issue specifically affects keys whose values are empty arrays and does not occur when `encode` is set to `false` or `encodeValuesOnly` is set to `true`.