Date: 2021-04-10 04:22
Posted By: Ruud van der Velden (ruudvdvelden)

phar_installer\app\wizard\class.wizard_step4.php: line 131
$this->_config['dbpass'] =
trim(\__appbase\utils::clean_string($_POST['dbpass']));


phar_installer\lib\classes\base\class.utils.php: line 69

    public static function clean_string($val)
    {
        if( !$val ) return $val;
        $val = (string) $val;
        $val = preg_replace("/\\\$/", "$", $val);
        $val = preg_replace("/\r/", "", $val);
        $val = str_replace("!", "!", $val);
        $val = str_replace("'", "'", $val);
        return strip_tags($val);
    }

strip_tags is the culprit here.
Example:

php > echo strip_tags('rando<m string');
rando
php >                                 

      

Date: 2021-06-12 05:07
Posted By: Ruud van der Velden (ruudvdvelden)

Fixed in svn for 2.2.16. Installer won't touch the password from input anymore.