From 6775465c2173615a3390ba0ea0593689c3c9844b Mon Sep 17 00:00:00 2001
From: ypsdf1 <nihaoshidifu@gitee.com>
Date: Tue, 7 Jul 2026 16:52:59 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D:=20=E8=AE=A2=E5=8D=95?=
 =?UTF-8?q?=E9=A1=B5JS=E8=AF=AD=E6=B3=95=E9=94=99=E8=AF=AF=E5=AF=BC?=
 =?UTF-8?q?=E8=87=B4=E6=B0=B8=E4=B9=85=E8=BD=AC=E5=9C=88(onclick=E5=86=85?=
 =?UTF-8?q?=E8=81=94JSON=E5=BC=95=E5=8F=B7=E5=86=B2=E7=AA=81=E6=94=B9data?=
 =?UTF-8?q?=E5=B1=9E=E6=80=A7+=E4=BA=8B=E4=BB=B6=E5=A7=94=E6=89=98)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 orders.php | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/orders.php b/orders.php
index d94c467..a42f790 100644
--- a/orders.php
+++ b/orders.php
@@ -177,7 +177,7 @@ async function loadOrders() {
             const items = (o.items_detail && Array.isArray(o.items_detail)) ? o.items_detail.map(i=>esc(i.name)+'x'+i.amount).join('、') : '';
             const disc = (parseInt(o.discount_percent)>0) ? ` <span class="disc">(${o.discount_percent}% off -${o.discount_amount})</span>` : '';
             const pmBadge = o.payment_method === 'cash' ? '<span style="color:var(--yellow)">[现金]</span>' : '';
-            return `<div class="order-row" onclick="showDetail(${escapeHtmlAttr(JSON.stringify(o))})">
+            return `<div class="order-row" data-order='${escapeHtmlAttr(JSON.stringify(o))}'>
                 <div class="ot">
                     <span class="ono">${esc(o.order_no)} ${pmBadge}</span>
                     <span>${o.operator_type==='admin'?'管理员':'收银员'}:${esc(o.operator_name)}</span>
@@ -193,8 +193,12 @@ async function loadOrders() {
 }
 
 function escapeHtmlAttr(str) {
-    // 安全转义JSON用于HTML属性中的onclick
-    return String(str).replace(/'/g, "&#39;").replace(/"/g, "&quot;");
+    // 安全转义JSON用于HTML属性（data-order）：先转 & 再转引号，
+    // 避免数据中的 & 被浏览器当成实体解码而破坏 JSON，且对单/双引号均做转义
+    return String(str)
+        .replace(/&/g, "&amp;")
+        .replace(/'/g, "&#39;")
+        .replace(/"/g, "&quot;");
 }
 
 function showDetail(orderData) {
@@ -232,6 +236,13 @@ function showDetail(orderData) {
 function closeDetail() { document.getElementById('detailOverlay').classList.remove('show'); }
 document.getElementById('detailOverlay').addEventListener('click', e => { if(e.target.id === 'detailOverlay') closeDetail(); });
 
+// ★ 订单行点击事件委托（替代 onclick 内联 JSON，避免引号冲突导致 SyntaxError）
+document.getElementById('orderList').addEventListener('click', e => {
+    const row = e.target.closest('.order-row');
+    if (!row) return;
+    try { showDetail(JSON.parse(row.dataset.order)); } catch(err) { console.error('订单数据解析失败:', err); }
+});
+
 // 启动
 if (STATE.logged_in) loadOrders();
 else document.getElementById('orderList').innerHTML = '<div class="empty-state">请先<a href="cashier.php" style="color:var(--accent)">登录收银台</a>后查看订单</div>';