補丁前: 

1. $order_sn = trim($_GET['out_trade_no']);

補丁后: 

1. $order_sn = trim(addslashes($_GET['out_trade_no']));