diff --git a/src/wp-admin/includes/user.php b/src/wp-admin/includes/user.php
index c6c08c4eaf76c..b5b6af4c6d51f 100644
--- a/src/wp-admin/includes/user.php
+++ b/src/wp-admin/includes/user.php
@@ -40,8 +40,8 @@ function edit_user( $user_id = 0 ) {
 		$update = false;
 	}
 
-	if ( ! $update && isset( $_POST['user_login'] ) ) {
-		$user->user_login = sanitize_user( wp_unslash( $_POST['user_login'] ), true );
+	if ( ! $update ) {
+		$user->user_login = isset( $_POST['user_login'] ) ? sanitize_user( wp_unslash( $_POST['user_login'] ), true ) : '';
 	}
 
 	$errors = new WP_Error();
diff --git a/tests/phpunit/tests/user.php b/tests/phpunit/tests/user.php
index 55aa40e95b409..4d37b86052cb0 100644
--- a/tests/phpunit/tests/user.php
+++ b/tests/phpunit/tests/user.php
@@ -2254,6 +2254,28 @@ public function action_check_passwords_blank_password( $user_login, &$pass1 ) {
 		$pass1 = '';
 	}
 
+	/**
+	 * Checks that calling edit_user() without a username when adding returns the username error.
+	 *
+	 * @ticket 36303
+	 *
+	 * @covers ::edit_user
+	 */
+	public function test_edit_user_missing_user_login() {
+		$_POST          = array();
+		$_GET           = array();
+		$_REQUEST       = array();
+		$_POST['role']  = 'subscriber';
+		$_POST['email'] = 'user1@example.com';
+		$_POST['pass1'] = 'password';
+		$_POST['pass2'] = 'password';
+
+		$response = edit_user();
+
+		$this->assertWPError( $response );
+		$this->assertContains( 'user_login', $response->get_error_codes() );
+	}
+
 	/**
 	 * @ticket 16470
 	 */