silverstripe-framework/docs/en/04_Changelogs/3.2.1.md

3.2.1

Upgrading

FormField validation messages generated by the Validator class will now be automatically XML encoded before being rendered alongside an invalid field.

If a validation message in a custom Validator instance should be rendered as literal HTML, then the $message parameter for Validator::validationError should be passed as an instance of HTMLText

For example:

:::php
class MyCustomValidator extends Validator {
	public function php($data) { 
		$this->validationError(
			'EmailAddress',
			DBField::create_field('HTMLText', "Invalid email. Please sign up at <a href='signup'>this page</a>")
		);
	}
}