Fix wrong escaped errors in Installer - Database settings

Awesome, thank you @rteijeiro.

This makes sure that $result is safe before concatenating it and the resulting string is always safe before SafeMarkup::set() is called on it.

YEAH! So happy to have this fixed this before beta. :)

Committed and pushed to 8.x. Thanks!

       if (!$success) {
-        $message .= '<p class="error">' . $result  . '</p>';
+        $message = SafeMarkup::isSafe($result) ? $result : String::checkPlain($result);
       }

But the code above will output only one error - the last one, right?

And why the error class was removed?

@Pere Orga is correct, this is wrong. Also we should just use SafeMarkup::escape(), then we don't need the use String;.

created a patch that took into account joelpittet's suggestions

forgot to upload the screenshot that demonstrates multiple error messages being displayed after the patch has been submitted.

@Cristian.Andrei thanks for the patch, the beauty of the SafeMarkup::escape() is that it does the isSafe() check inside it.

I'm not sure yet how best to deal with @Pere Orga's point, but it will likely need to be building up an array for $message and if all items are SafeMarkup::escape()'d we can SafeMarkup::set() the imploded array.

@joelpittet, you're welcome.

Can't help but wonder as to why would we need to build up an array for $message ? The functionality is there and it seems to work pretty much OK.

@Cristian.Andrei
Because of this comment by @Pere Orga

But the code above will output only one error - the last one, right?

Before the string was producing concatenated markup to build out the string. By concatenating another string onto the string marked safe it is no longer a safe string.

But actually you are totally right, this doesn't need to be an array, it can stay concatenation, I don't know what I was thinking:S

@lauriii mind tackling that?
Concatenate the $message string like before, leave the SafeMarkup::escape() as you have itt in #16 and SafeMarkup::set() the resulting $message. That way we won't get double escape, it will escape if necessary, and concatenated.

Created follow-up