From daf3055b429e26e641038229e6e5dd171ffb895e Mon Sep 17 00:00:00 2001
From: xboard <xboard@xboard.one>
Date: Mon, 30 Mar 2026 01:46:56 +0800
Subject: [PATCH] fix: escape Telegram Markdown special characters

---
 app/Utils/Helper.php        | 10 ++++++++++
 plugins/Telegram/Plugin.php | 10 +++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/app/Utils/Helper.php b/app/Utils/Helper.php
index 1cc1bf7..707196b 100644
--- a/app/Utils/Helper.php
+++ b/app/Utils/Helper.php
@@ -229,4 +229,14 @@ class Helper
     {
         return $transfer_enable / 1073741824;
     }
+
+    /**
+     * 转义 Telegram Markdown 特殊字符
+     * @param string $text
+     * @return string
+     */
+    public static function escapeMarkdown(string $text): string
+    {
+        return str_replace(['_', '*', '`', '['], ['\_', '\*', '\`', '\['], $text);
+    }
 }
diff --git a/plugins/Telegram/Plugin.php b/plugins/Telegram/Plugin.php
index 01812f9..a5c61b1 100644
--- a/plugins/Telegram/Plugin.php
+++ b/plugins/Telegram/Plugin.php
@@ -58,8 +58,8 @@ class Plugin extends AbstractPlugin
       "支付渠道：%s\n" .
       "本站订单：`%s`",
       $order->total_amount / 100,
-      $payment->payment,
-      $payment->name,
+      Helper::escapeMarkdown($payment->payment),
+      Helper::escapeMarkdown($payment->name),
       $order->trade_no
     );
     $this->telegramService->sendMessageWithAdmin($message, true);
@@ -92,7 +92,7 @@ class Plugin extends AbstractPlugin
     $TGmessage .= "📍 位置: `{$region}`\n";
 
     if ($plan) {
-      $TGmessage .= "📦 套餐: `{$plan->name}`\n";
+      $TGmessage .= "📦 套餐: `" . Helper::escapeMarkdown($plan->name) . "`\n";
       $TGmessage .= "📊 流量: `{$remaining_traffic}G / {$transfer_enable}G` (剩余/总计)\n";
       $TGmessage .= "⬆️⬇️ 已用: `{$u}G / {$d}G`\n";
       $TGmessage .= "⏰ 到期: `{$expired_at}`\n";
@@ -103,8 +103,8 @@ class Plugin extends AbstractPlugin
     $TGmessage .= "💰 余额: `{$money}元`\n";
     $TGmessage .= "💸 佣金: `{$affmoney}元`\n";
     $TGmessage .= "━━━━━━━━━━━━━━━━━━━━\n";
-    $TGmessage .= "📝 *主题*: `{$ticket->subject}`\n";
-    $TGmessage .= "💬 *内容*: `{$message->message}`";
+    $TGmessage .= "📝 *主题*: `" . Helper::escapeMarkdown($ticket->subject) . "`\n";
+    $TGmessage .= "💬 *内容*: `" . Helper::escapeMarkdown($message->message) . "`";
     $this->telegramService->sendMessageWithAdmin($TGmessage, true);
   }