From 05b652014092ae891e6ce9b3e91bd52608253ef8 Mon Sep 17 00:00:00 2001
From: Milky0217 <m943790568@163.com>
Date: Thu, 7 May 2026 16:27:27 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=94=AF=E4=BB=98=E5=AE=9D=E8=A1=A8?=
 =?UTF-8?q?=E5=8D=95=E6=B7=BB=E5=8A=A0=20HTML=20=E8=BD=AC=E4=B9=89?=
 =?UTF-8?q?=EF=BC=8C=E9=98=B2=E6=AD=A2=20JSON=20=E5=8F=8C=E5=BC=95?=
 =?UTF-8?q?=E5=8F=B7=E7=A0=B4=E5=9D=8F=E5=B1=9E=E6=80=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/handlers/payment.rs | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/handlers/payment.rs b/src/handlers/payment.rs
index a21dd0d..7a88fe4 100644
--- a/src/handlers/payment.rs
+++ b/src/handlers/payment.rs
@@ -170,17 +170,23 @@ fn build_alipay_form_html(
 
     let sign = rsa2_sign(&sign_source, &config.private_key)?;
 
-    // 生成自动提交的表单 HTML（使用原始值，浏览器会自动 URL 编码）
+    // 生成自动提交的表单 HTML（HTML 转义防止特殊字符破坏属性）
+    fn h(s: &str) -> String {
+        s.replace('&', "&amp;")
+            .replace('"', "&quot;")
+            .replace('<', "&lt;")
+            .replace('>', "&gt;")
+    }
     let mut form_fields = String::new();
     for (k, v) in &params {
         form_fields.push_str(&format!(
             r#"<input type="hidden" name="{}" value="{}" />"#,
-            k, v
+            h(k), h(v)
         ));
     }
     form_fields.push_str(&format!(
         r#"<input type="hidden" name="sign" value="{}" />"#,
-        &sign
+        h(&sign)
     ));
 
     let html = format!(