RC4 has a variable length key. Is it still necessary to use a key derivation function, such as PBKDF2, to initialize it?
Would using a single character password weaken it's output when compared to a block cipher using, for example, the SHA-256 hash of that same single character password as the key?
One problem with RC4 is that, while it does take a variable length input (up to 256 bytes), it's known not to be great at mixing those bytes together. Specifically, we see correlations between the RC4 key and the RC4 output stream.
My first recommendation to you would be to use something other than RC4. About the only advantage RC4 has over most other ciphers is that it is simple enough to be memorizable; for example, if you are going someplace where you don't want to carry any programs with you, if you can get access to anything programmable, you can type in an RC4 program, and have a good chance at having it work properly. If you don't care about that (and you probably don't), then there are better options available.
My second recommendation (assuming that you ignore the first) is that you ought to obscure the relationship between your password and the RC4 key (as RC4 doesn't do a great job of obscuring the relationship between the RC4 key and the keystream). Using a KDF to process the password would work; at the very least, you should use a hash function. Now, I don't know whether the weaknesses in the RC4 key setup logic would be a concern to you; I also don't know that it's not; covering that potential weakness would appear to be a prudent step.
As for a single character password, well, that's going to be weak, whether you use a block cipher or RC4....
Poncho does a good job of explaining why you could use a KDF before RC4. But you are talking about a password and a PBKDF. A PBKDF does more than just provide a good way to extract entropy from the given input (the password):
It uses a salt, which can be used to protect against rainbow tables (which could be created for known plaintext). This salt could also be used instead of a nonce (or IV) as RC4 does not have one by default. Of course the salt should be changed and saved with the ciphertext for every encryption.
It uses an work factor (iteration count for PBKDF2), which adds a limited amount of security to relatively weak passwords. Single character passwords are never good enough, as Poncho already stated.
So in all it is strongly recommended to use a PBKDF such as PBKDF2 when a password is provided instead of a key. This is not just true for RC4, it's true for any cipher.
Just using SHA-256 over the password doesn't cut it, as it does not include the salt and iteration count. It is possible to integrate those, but that would amount to building a proprietary PBKDF.
