fix(install): make the database identifier validators reject bad input

[elcreator]

Summary

The web installer's identifier validators never rejected anything. validateDbName(), validateDbCollation() and validateTablePrefix() failed only when preg_match(...) === false, which happens on a regex error, not on a mismatch (0). The unchecked values reached:

• CREATE DATABASE, where the collation went in unquoted on MySQL
• SELECT COUNT(*) FROM {prefix}site_content in the connection test and summary
• the generated core/config/database/connections/default.php: install.php wrote $_POST['tableprefix'] without validating it at all

The installer only runs before a site is installed, with database credentials the person running it supplies, so the practical impact is limited. The checks were still no-ops.

Changes

• Validators require a match.
  • Database names allow [A-Za-z0-9_$-], up to 63 characters. A leading digit and $ are accepted so existing databases still upgrade.
  • Collations may contain @ (PostgreSQL sr_RS@latin) or be empty.
  • The collation error message said "Database name"; it now says "Database collation".
• connection/databasetest.php now validates the collation, which it read raw. A rejected value is reported as the installer's red "failed!" status instead of a PHP fatal with a stack trace.
• install.php validates the table prefix before writing it to the config.
• Legacy assets/modules/store/installer/instprocessor.php (deprecated, no longer included; the store uses instprocessor-fast.php):
  • row ids are cast to int
  • package event names are escaped
  • an undefined $dbase. that made a DELETE invalid is removed

Not changed

validateDbUser() and validateAdminUsername() have the same === false bug. Their values only reach PDO and the ORM, not SQL text, and enforcing their current patterns would reject names in use today, such as DB users with - or . and email-style admin names. Worth a separate decision.

Test plan

• InstallerIdentifierValidationTest (34 tests): accepts real MySQL, PostgreSQL and SQLite names and collations; rejects quote, backtick, ;, comment, path and PHP payloads; checks the call sites. 16 of these fail on 3.5.x.
• tests/Unit/Install green.
• Manually on a fresh SQLite installer: the database test reports "failed!" for x; DROP TABLE evo_users; -- as prefix, ../../evil as name and utf8'; -- as collation, and passes evo_ / evolution / utf8.

🤖 Generated with Claude Code