But is it the right way?
There are various padding styles for this. The padding must be removed correctly and uniquely. For example, the all-zero padding may remove your actual information. Some of the padding schemes;
For such algorithms, the method shall be to pad the input at the trailing end with k - (l mod k) octets all having value k - (l mod k), where l is the length of the input.
The right way, indeed using a mode like CTR so that you will not need padding. The paddings have security issues like padding oracle attacks in CBC mode.
Can somebody crack my key, by sending empty Strings?
What is an empty string, all-zero? Why do you need to send all-zero? What is the Mode of operation? There are lots of questions about this. That really depends on your application. For example, it may reveal that you send it again if you are using ECB mode - don't use it. If you use a semantically secure mode you can be fine, however, keep in mind that each mode has its own problems. For example; in CBC mode the nonce must be unpredictable, In GCM, CTR the IV must be unique.
Use modern encryption modes like Authenticated Encryption (AE). AE will provide you Confidentiality, Integrity, and Authentication. AE examples are AES-GCM and ChaCha20-Poly1305 which are in TLS 1.3. AES-GCM internally uses CTR mode that no need a padding scheme.