Prevent self-xss via invalid mysql user name on install screen

Signed-off-by: Joas Schilling <coding@schilljs.com>

diff --git a/core/templates/installation.php b/core/templates/installation.php
index de9427a74d8dd42e35095d923c2cb1cc529183aa..36f5f5bfc6d61c33d12c580e0c19a1c075390e23 100644 (file)
--- a/core/templates/installation.php
+++ b/core/templates/installation.php
@@ -15,10 +15,10 @@ script('core', [
                <?php foreach($_['errors'] as $err): ?>
                <p>
                        <?php if(is_array($err)):?>
-                               <?php print_unescaped($err['error']); ?>
-                               <span class='hint'><?php print_unescaped($err['hint']); ?></span>
+                               <?php p($err['error']); ?>
+                               <span class='hint'><?php p($err['hint']); ?></span>
                        <?php else: ?>
-                               <?php print_unescaped($err); ?>
+                               <?php p($err); ?>
                        <?php endif; ?>
                </p>
                <?php endforeach; ?>