diff --git a/erpnext/templates/pages/order.html b/erpnext/templates/pages/order.html
index 0805a32ae33..5563a58b730 100644
--- a/erpnext/templates/pages/order.html
+++ b/erpnext/templates/pages/order.html
@@ -140,7 +140,7 @@
 				<div class="col-sm-12">
 					{% for attachment in attachments %}
 					<p class="small">
-						<a href="{{ attachment.file_url }}" target="blank"> {{ attachment.file_name }} </a>
+						<a href="{{ attachment.file_url|e }}" target="blank"> {{ attachment.file_name|e }} </a>
 					</p>
 					{% endfor %}
 				</div>
diff --git a/erpnext/templates/pages/projects.html b/erpnext/templates/pages/projects.html
index d88088c9819..e671e91db2f 100644
--- a/erpnext/templates/pages/projects.html
+++ b/erpnext/templates/pages/projects.html
@@ -82,11 +82,11 @@
     <div class="project-attachments">
       {% for attachment in doc.attachments %}
         <div class="attachment">
-          <a class="no-decoration attachment-link" href="{{ attachment.file_url }}" target="blank">
+          <a class="no-decoration attachment-link" href="{{ attachment.file_url|e }}" target="blank">
             <div class="row">
               <div class="col-xs-9">
                 <span class="indicator red file-name">
-                  {{ attachment.file_name }}</span>
+                  {{ attachment.file_name|e }}</span>
               </div>
               <div class="col-xs-3">
                 <span class="pull-right file-size">{{ attachment.file_size }}</span>
@@ -101,8 +101,8 @@
 </div>
 
 <script>
-  { % include "frappe/public/js/frappe/provide.js" % }
-  { % include "frappe/public/js/frappe/form/formatters.js" % }
+  {% include "frappe/public/js/frappe/provide.js" %}
+  {% include "frappe/public/js/frappe/form/formatters.js" %}
  </script>
 
 {% endblock %}