Steps to replicate the issue:
- Run install.php maintenance script with --dbpass option providing a value that contains a $ (dollar sign) (e.g. abc$def)
What happens?
The generated LocalSettings.php contains the line:
$wgDBpassword = "abc$def";
This causes an error, since $def is not escaped.
What should have happened instead?
The generated LocalSettings.php should contain:
$wgDBpassword = 'abc$def';
Note the single quotes (') rather than double quotes (")
Software version:
MediaWiki versions since roughly 2010 up to present