Turning magic_quotes_gpc on and off did not produce any different results. I gather this was unexpected so I tried tracing the code. This is what I found:
 * step2 receives the password, mangled by magic_quotes_gpc, from the user
 * step2 calls store_steps(), which
  * calls $stripslashes to counteract magic_quotes_gpc, then
  * calls urlencode() to turn it into a %-escaped form that will not be further mangled by magic_quotes_gpc
 * write_config_file() receives $db_pwd in its %-escaped form
  * So we call urldecode() to turn it back a password
  * Because store_steps() has already called $stripslashes, magic_quotes_gpc is already irrelevant at this point so we *do not* call $addslashes
  * We are writing out a PHP string literal, so we call addslashes() to produce that

We can logically infer that addslashes() is correct and magic_quotes_gpc has no effect on this section of the code.