Upgrade xorm to latest to fix insert issue bug (#8309)

* upgrade xorm to latest to fix insert issue bug

* add newissue unit tests

* update xorm version

* fix tests

vendor/github.com/go-xorm/xorm/statement_args.go

@@ -49,15 +49,34 @@ func quoteNeeded(a interface{}) bool {
 	return true
 }
 
-func convertArg(arg interface{}) string {
+func convertStringSingleQuote(arg string) string {
+	return "'" + strings.Replace(arg, "'", "''", -1) + "'"
+}
+
+func convertString(arg string) string {
+	var buf strings.Builder
+	buf.WriteRune('\'')
+	for _, c := range arg {
+		if c == '\\' || c == '\'' {
+			buf.WriteRune('\\')
+		}
+		buf.WriteRune(c)
+	}
+	buf.WriteRune('\'')
+	return buf.String()
+}
+
+func convertArg(arg interface{}, convertFunc func(string) string) string {
 	if quoteNeeded(arg) {
 		argv := fmt.Sprintf("%v", arg)
-		return "'" + strings.Replace(argv, "'", "''", -1) + "'"
+		return convertFunc(argv)
 	}
 
 	return fmt.Sprintf("%v", arg)
 }
 
+const insertSelectPlaceHolder = true
+
 func (statement *Statement) writeArg(w *builder.BytesWriter, arg interface{}) error {
 	switch argv := arg.(type) {
 	case bool:
@@ -93,8 +112,19 @@ func (statement *Statement) writeArg(w *builder.BytesWriter, arg interface{}) er
 			return err
 		}
 	default:
-		if _, err := w.WriteString(convertArg(arg)); err != nil {
-			return err
+		if insertSelectPlaceHolder {
+			if err := w.WriteByte('?'); err != nil {
+				return err
+			}
+			w.Append(arg)
+		} else {
+			var convertFunc = convertStringSingleQuote
+			if statement.Engine.dialect.DBType() == core.MYSQL {
+				convertFunc = convertString
+			}
+			if _, err := w.WriteString(convertArg(arg, convertFunc)); err != nil {
+				return err
+			}
 		}
 	}
 	return nil