补丁前:
$order_sn = trim($_GET['out_trade_no']);
补丁后:
$order_sn = trim(addslashes($_GET['out_trade_no']));