Index: typo3/sysext/install/mod/class.tx_install.php
===================================================================
--- typo3/sysext/install/mod/class.tx_install.php	(Revision 8202)
+++ typo3/sysext/install/mod/class.tx_install.php	(Arbeitskopie)
@@ -908,8 +908,8 @@
 					There is no connection to the database!
 				</strong>
 				<br />
-				(Username: <em>' . TYPO3_db_username . '</em>,
-				Host: <em>' . TYPO3_db_host . '</em>,
+				(Username: <em>' . htmlspecialchars(TYPO3_db_username) . '</em>,
+				Host: <em>' . htmlspecialchars(TYPO3_db_host) . '</em>,
 				Using Password: YES)
 				<br />
 				Go to Step 1 and enter a valid username and password!
@@ -918,7 +918,7 @@
 		$error_missingDB = '
 			<p class="typo3-message message-error">
 				<strong>
-					There is no access to the database (<em>' . TYPO3_db . '</em>)!
+					There is no access to the database (<em>' . htmlspecialchars(TYPO3_db) . '</em>)!
 				</strong>
 				<br />
 				Go to Step 2 and select a valid database!
@@ -994,11 +994,11 @@
 						'encryptionKey' => $this->createEncryptionKey(),
 						'branch' => TYPO3_branch,
 						'labelUsername' => 'Username',
-						'username' => TYPO3_db_username,
+						'username' => htmlspecialchars(TYPO3_db_username),
 						'labelPassword' => 'Password',
-						'password' => TYPO3_db_password,
+						'password' => htmlspecialchars(TYPO3_db_password),
 						'labelHost' => 'Host',
-						'host' => TYPO3_db_host ? TYPO3_db_host : 'localhost',
+						'host' => TYPO3_db_host ? htmlspecialchars(TYPO3_db_host) : 'localhost',
 						'continue' => 'Continue',
 						'llDescription' => 'If you have not already created a username and password to access the database, please do so now. This can be done using tools provided by your host.'
 					);
@@ -1145,11 +1145,11 @@
 							$step4SubPartMarkers = array(
 								'llSummary' => 'Database summary:',
 								'llUsername' => 'Username:',
-								'username' => TYPO3_db_username,
+								'username' => htmlspecialchars(TYPO3_db_username),
 								'llHost' => 'Host:',
-								'host' => TYPO3_db_host,
+								'host' => htmlspecialchars(TYPO3_db_host),
 								'llDatabase' => 'Database:',
-								'database' => TYPO3_db,
+								'database' => htmlspecialchars(TYPO3_db),
 								'llNumberTables' => 'Number of tables:',
 								'numberTables' => count($whichTables),
 								'action' => htmlspecialchars($this->action),
@@ -3114,9 +3114,9 @@
 					<p>
 						You may need to enter data for these values:
 						<br />
-						Username: <strong>' . TYPO3_db_username . '</strong>
+						Username: <strong>' . htmlspecialchars(TYPO3_db_username) . '</strong>
 						<br />
-						Host: <strong>' . TYPO3_db_host . '</strong>
+						Host: <strong>' . htmlspecialchars(TYPO3_db_host) . '</strong>
 						<br />
 						<br />
 						Use the form below.
@@ -3130,13 +3130,13 @@
 							Username:
 						</dt>
 						<dd>
-							' . TYPO3_db_username . '
+							' . htmlspecialchars(TYPO3_db_username) . '
 						</dd>
 						<dt>
 							Host:
 						</dt>
 						<dd>
-							' . TYPO3_db_host . '
+							' . htmlspecialchars(TYPO3_db_host) . '
 						</dd>
 					</dl>
 				', -1, 1);
@@ -3153,7 +3153,7 @@
 				} elseif (!$GLOBALS['TYPO3_DB']->sql_select_db(TYPO3_db))  {
 					$this->message($ext, 'Database', '
 						<p>
-							\''.TYPO3_db.'\' could not be selected as database!
+							\'' . htmlspecialchars(TYPO3_db) . '\' could not be selected as database!
 							<br />
 							Please select another one or create a new database.
 						</p>
@@ -3162,7 +3162,7 @@
 				} else  {
 					$this->message($ext, 'Database', '
 						<p>
-							<strong>' . TYPO3_db . '</strong> is selected as
+							<strong>' . htmlspecialchars(TYPO3_db) . '</strong> is selected as
 							database.
 						</p>
 					', 1, 1);
@@ -3181,9 +3181,9 @@
 					<p>
 						Connecting to SQL database failed with these settings:
 						<br />
-						Username: <strong>' . TYPO3_db_username . '</strong>
+						Username: <strong>' . htmlspecialchars(TYPO3_db_username) . '</strong>
 						<br />
-						Host: <strong>' . TYPO3_db_host . '</strong>
+						Host: <strong>' . htmlspecialchars(TYPO3_db_host) . '</strong>
 					</p>
 					<p>
 						Make sure you\'re using the correct set of data.
@@ -4398,25 +4398,25 @@
 					ImageMagick enabled:
 				</dt>
 				<dd>
-					' . $GLOBALS['TYPO3_CONF_VARS']['GFX']['im'] . '
+					' . htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['im']) . '
 				</dd>
 				<dt>
 					ImageMagick path:
 				</dt>
 				<dd>
-					' . $im_path . ' <span>(' . $im_path_version . ')</span>
+					' . htmlspecialchars($im_path . ' <span>(' . htmlspecialchars($im_path_version) . ')</span>
 				</dd>
 				<dt>
 					ImageMagick path/LZW:
 				</dt>
 				<dd>
-					' . $im_path_lzw . ' <span>(' . $im_path_lzw_version . ')</span>
+					' . htmlspecialchars($im_path_lzw . ' <span>(' . htmlspecialchars($im_path_lzw_version) . ')</span>
 				</dd>
 				<dt>
 					Version 5/GraphicsMagick flag:
 				</dt>
 				<dd>
-					' . ($GLOBALS['TYPO3_CONF_VARS']['GFX']['im_version_5'] ? $GLOBALS['TYPO3_CONF_VARS']['GFX']['im_version_5'] : '&nbsp;') . '
+					' . ($GLOBALS['TYPO3_CONF_VARS']['GFX']['im_version_5'] ? htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['im_version_5']) : '&nbsp;') . '
 				</dd>
 			</dl>
 			<dl id="t3-install-imageprocessingother">
@@ -4424,33 +4424,33 @@
 					GDLib enabled:
 				</dt>
 				<dd>
-					' . ($GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib'] ? $GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib'] : '&nbsp;') . '
+					' . ($GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib'] ? htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib']) : '&nbsp;') . '
 				</dd>
 				<dt>
 					GDLib using PNG:
 				</dt>
 				<dd>
-					' . ($GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib_png'] ? $GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib_png'] : '&nbsp;') . '
+					' . ($GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib_png'] ? htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['gdlib_png']) : '&nbsp;') . '
 				</dd>
 				<dt>
 					IM5 effects enabled:
 				</dt>
 				<dd>
-					' . $GLOBALS['TYPO3_CONF_VARS']['GFX']['im_v5effects'] . '
+					' . htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['im_v5effects']) . '
 					<span>(Blurring/Sharpening with IM 5+)</span>
 				</dd>
 				<dt>
 					Freetype DPI:
 				</dt>
 				<dd>
-					' . $GLOBALS['TYPO3_CONF_VARS']['GFX']['TTFdpi'] . '
+					' . htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['TTFdpi']) . '
 					<span>(Should be 96 for Freetype 2)</span>
 				</dd>
 				<dt>
 					Mask invert:
 				</dt>
 				<dd>
-					' . $GLOBALS['TYPO3_CONF_VARS']['GFX']['im_imvMaskState'] . '
+					' . htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['im_imvMaskState']) . '
 					<span>(Should be set for some IM versions approx. 5.4+)</span>
 				</dd>
 			</dl>
@@ -4459,7 +4459,7 @@
 					File Formats:
 				</dt>
 				<dd>
-					' . $GLOBALS['TYPO3_CONF_VARS']['GFX']['imagefile_ext'] . '
+					' . htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['imagefile_ext']) . '
 				</dd>
 			</dl>
 		';
@@ -4482,8 +4482,8 @@
 			$msg .= '
 				<p>
 					Warning: Mismatch between the version of ImageMagick' .
-					' (' . $im_path_version.') and the configuration of ' .
-					'[GFX][im_version_5] (' . $GLOBALS['TYPO3_CONF_VARS']['GFX']['im_version_5'] . ')
+					' (' . htmlspecialchars($im_path_version) . ') and the configuration of ' .
+					'[GFX][im_version_5] (' . htmlspecialchars($GLOBALS['TYPO3_CONF_VARS']['GFX']['im_version_5']) . ')
 				</p>
 			';
 			$etype=2;
@@ -5417,20 +5417,20 @@
 					Username:
 				</dt>
 				<dd>
-					' . TYPO3_db_username . '
+					' . htmlspecialchars(TYPO3_db_username) . '
 				</dd>
 				<dt>
 					Host:
 				</dt>
 				<dd>
-					' . TYPO3_db_host . '
+					' . htmlspecialchars(TYPO3_db_host) . '
 				</dd>
 			</dl>
 		', -1, 1);
 
 		$this->message($headCode, 'Database', '
 			<p>
-				<strong>' . TYPO3_db . '</strong> is selected as database.
+				<strong>' . htmlspecialchars(TYPO3_db) . '</strong> is selected as database.
 				<br />
 				Has <strong>' . count($whichTables) . '</strong> tables.
 			</p>
Index: typo3/sysext/install/updates/class.tx_coreupdates_compatversion.php
===================================================================
--- typo3/sysext/install/updates/class.tx_coreupdates_compatversion.php	(Revision 8202)
+++ typo3/sysext/install/updates/class.tx_coreupdates_compatversion.php	(Arbeitskopie)
@@ -98,7 +98,7 @@
 				<p>
 					Your current TYPO3 installation is configured to
 					<strong>behave like version
-					' . $TYPO3_CONF_VARS['SYS']['compat_version'] . '
+					' . htmlspecialchars($TYPO3_CONF_VARS['SYS']['compat_version']) . '
 					</strong> of TYPO3. If you just upgraded from this version,
 					you most likely want to <strong>use new features</strong> as
 					well.
@@ -153,7 +153,7 @@
 		} else {
 			$content = '
 				<p>
-					TYPO3 output is currently compatible to version ' . $TYPO3_CONF_VARS['SYS']['compat_version'] . '.
+					TYPO3 output is currently compatible to version ' . htmlspecialchars($TYPO3_CONF_VARS['SYS']['compat_version']) . '.
 					To use all the new features in the current TYPO3 version,
 					make sure you follow the guidelines below to upgrade without
 					problems.