fix: escape party name and contact display on order page

erpnext/templates/pages/order.html

@@ -73,11 +73,11 @@
 			</div>
 			<div class="text-right col-2">
 				{%- set party_name = doc.supplier_name if doc.doctype in ['Supplier Quotation', 'Purchase Invoice', 'Purchase Order'] else doc.customer_name %}
-				<b>{{ party_name }}</b>
+				<b>{{ party_name | e }}</b>
 
 				{% if doc.contact_display and doc.contact_display != party_name %}
 					<br>
-					{{ doc.contact_display }}
+					{{ doc.contact_display | e }}
 				{% endif %}
 			</div>
 		</div>