Fixed a potential reflected XSS on install.php

Thanks to Chris Liu for reporting it.