Escape in correct places to avoid double escaping sometimes

libraries/config/ConfigFile.class.php

@@ -422,10 +422,10 @@ class ConfigFile
         }
         $verbose = $this->get("Servers/$id/verbose");
         if (!empty($verbose)) {
-            return htmlspecialchars($verbose);
+            return $verbose;
         }
         $host = $this->get("Servers/$id/host");
-        return empty($host) ? 'localhost' : htmlspecialchars($host);
+        return empty($host) ? 'localhost' : $host;
     }
 
     /**

setup/lib/index.lib.php

@@ -279,6 +279,7 @@ function perform_config_checks()
         if ($server_name == 'localhost') {
             $server_name .=  " [$i]";
         }
+        $server_name = htmlspecialchars($server_name);
 
         if ($cookie_auth_server && $blowfish_secret === null) {
             $blowfish_secret = uniqid('', true);