Index: branches/5.3.x/core/install.php
===================================================================
diff -u -N -r15649 -r15677
--- branches/5.3.x/core/install.php	(.../install.php)	(revision 15649)
+++ branches/5.3.x/core/install.php	(.../install.php)	(revision 15677)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: install.php 15649 2012-12-12 09:40:30Z alex $
+* @version	$Id: install.php 15677 2013-01-17 18:52:50Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -243,7 +243,15 @@
 		 */
 		private function GetVar($name, $default = false)
 		{
-			return array_key_exists($name, $_REQUEST) ? $_REQUEST[$name] : $default;
+			if ( array_key_exists($name, $_COOKIE) ) {
+				return $_COOKIE[$name];
+			}
+
+			if ( array_key_exists($name, $_POST) ) {
+				return $_POST[$name];
+			}
+
+			return array_key_exists($name, $_GET) ? $_GET[$name] : $default;
 		}
 
 		/**
@@ -256,7 +264,7 @@
 		 */
 		private function SetVar($name, $value)
 		{
-			$_REQUEST[$name] = $value;
+			$_POST[$name] = $value;
 		}
 
 		/**
@@ -851,10 +859,11 @@
 
 				case 'root_password':
 					// update root password in database
-					$password = md5( md5($this->Application->GetVar('root_password')) . 'b38');
+					$password_formatter = $this->Application->recallObject('kPasswordFormatter');
+					/* @var $password_formatter kPasswordFormatter */
 
 					$config_values = Array (
-						'RootPass' => $password,
+						'RootPass' => $password_formatter->hashPassword($this->Application->GetVar('root_password')),
 						'Backup_Path' => FULL_PATH . $this->toolkit->getSystemConfig('Misc', 'WriteablePath') . DIRECTORY_SEPARATOR . 'backupdata',
 						'DefaultEmailSender' => 'portal@' . $this->toolkit->getSystemConfig('Misc', 'Domain')
 					);
@@ -1734,7 +1743,7 @@
 		 */
 		function DBErrorHandler($code, $msg, $sql)
 		{
-			$this->errorMessage = 'Query: <br />'.htmlspecialchars($sql).'<br />execution result is error:<br />['.$code.'] '.$msg;
+			$this->errorMessage = 'Query: <br />'.htmlspecialchars($sql, null, 'UTF-8').'<br />execution result is error:<br />['.$code.'] '.$msg;
 			return true;
 		}