Comment 4 for bug 1887252

@Hongyi Zhao: As you wrote in the duplicate bug, my simplistic code in comment #2, which only escapes the '<' character, would not be sufficient. At the same time the issue I mentioned, about --no-markup making \n being displayed literally instead of interpreted as a newline, still stands.

Probably this variant would do it:

TEXT=$(printf '%s' "$TEXT" | sed 's/&/\&amp;/g;
                                  s/</\&lt;/g;
                                  s/>/\&gt;/g;
                                  s/"/\&quot;/g;
                                  s/'"'"'/\&#39;/g')

But before making the change, I would appreciate some feedback from you or others that that addition to /etc/gdm3/config-error-dialog.sh would address the issues you have observed.