fix(back): platform-orders/create back 预清洗 + 表单 hidden back 条件渲染护栏

tests/Feature/AdminPlatformOrderCreateBackValidationTest.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformOrderCreateBackValidationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_create_should_not_echo_back_hidden_input_when_back_contains_quotes_or_brackets(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $unsafeBack = '/admin/site-subscriptions?keyword="x"&a=<b>';
+
+        $res = $this->get('/admin/platform-orders/create?back=' . urlencode($unsafeBack));
+        $res->assertOk();
+
+        // back 被清洗为空：不应回显 hidden back input，也不应出现 unsafeBack
+        $res->assertDontSee('name="back"', false);
+        $res->assertDontSee($unsafeBack, false);
+
+        // 返回按钮应回退到默认列表
+        $res->assertSee('href="/admin/platform-orders"', false);
+    }
+}