Trying to resolve the security scanner issue creates problem while installing the managed package?

Question

The following class inserts Data in a custom object(SAPConfiguration__c),when a user enters data in a Visualforce page.

In order to rectify the Security Scanner issue(Query: FLS Create) I have added isCreateable() method(commented as "Based on Security Scanner Issue" in code).But when we install the managed Package, the code is not working properly?Data's are not getting inserted?What could be the reason?

   public with sharing class customConfig
{
//public transient String myValueFromPage{get; set;}
public transient String UserName{get; set;}
public transient String password{get; set;}
public transient String Url{get; set;}
public transient String Cert{get;set;}
//public ApexPages.StandardSetController User__c{get; set;}
public Pagereference sample() {
try {
if(Schema.sObjectType.SAPConfiguration__c.isUpdateable()){
    //
/********************Based on Security Scanner Issue********************/
   /* String [] Subfield = new String [] {'Name','eSyConnector_Endpoint__c','password__c','username__c','SSL_Certificate_Name__c','SetupOwnerId'};
        Map<String,Schema.SObjectField> m = Schema.SObjectType.SAPConfiguration__c.fields.getMap();
           for (String fieldToCheck : Subfield) {
               if (!m.get(fieldToCheck).getDescribe().isCreateable()) {
                        ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                                                            'Insufficient access')); 
                       }
               }
               for (String fieldToCheckupdate : Subfield) {
                 if (!m.get(fieldToCheckupdate).getDescribe().isUpdateable()) {
                     ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                                                            'Insufficient access')); 
                       }

               }*/
/********************END Security Scanner********************/
    SAPConfiguration__c sap1=new SAPConfiguration__c();
    sap1.Name='eSy Connector Config';
    sap1.eSyConnector_Endpoint__c=Url;
    sap1.password__c=password;
    sap1.username__c=UserName;
    sap1.SSL_Certificate_Name__c=Cert;

 sap1.SetupOwnerId=UserInfo.getOrganizationId();
    upsert sap1 Name;
}

} catch(Exception e) {
    //system.debug('An unexpected error has occurred: ' + e.getMessage());
}
 PageReference page = new PageReference('/apex/thankyou');
        page.setRedirect(true); 
        return page;
        }
        }

Answer 1

If these fields are part of your managed package:

String[] Subfield = new String [] {'Name','eSyConnector_Endpoint__c','password__c','username__c','SSL_Certificate_Name__c','SetupOwnerId'};

then if you are using API 34.0 or later you will need to include the namespace prefix of the fields in their names.

But if the set of fields is fixed and in your managed package, you can just write the code to use the SObjectField tokens directly and side-step this problem:

SObjectField[] fields = new SObjectField[] {
        SAPConfiguration__c.Name,
        SAPConfiguration__c.eSyConnector_Endpoint__c,
        ...
        };

 for (SObjectField f : fields) {
     if (!f.getDescribe().isCreateable()) {
         ...
     }
 }