xss on setup config page

How it was found

Nextcloud version: 18.0.1 In setup config page，setting mysql Username with payload<script>alert(1)</script>, and set others. F739076 then submit . F739077 this gif will show poc: F739069

Impact

This is because the code does not filter dangerous characters. so dangerous characters need to be escaped.