diff --git a/addons/portal_sale/portal_sale.py b/addons/portal_sale/portal_sale.py
index 62f3f1ff9cc..3556fd5ca0e 100644
--- a/addons/portal_sale/portal_sale.py
+++ b/addons/portal_sale/portal_sale.py
@@ -74,6 +74,14 @@ class sale_order(osv.Model):
             mail_obj.send(cr, uid, [mail_id], recipient_ids=[partner.id], context=context)
         return super(sale_order, self).action_button_confirm(cr, uid, ids, context=context)
 
+    def get_signup_url(self, cr, uid, ids, context=None):
+        assert len(ids) == 1
+        document = self.browse(cr, uid, ids[0], context=context)
+        partner = document.partner_id
+        action = 'portal_sale.action_quotations_portal' if document.state in ('draft', 'sent') else 'portal_sale.action_orders_portal'
+        partner.signup_prepare()
+        return partner._get_signup_url_for_action(action=action, view_type='form', res_id=document.id)[partner.id]
+
 
 class account_invoice(osv.Model):
     _inherit = 'account.invoice'
@@ -126,6 +134,14 @@ class account_invoice(osv.Model):
             mail_obj.send(cr, uid, [mail_id], recipient_ids=[partner.id], context=context)
         return super(account_invoice, self).invoice_validate(cr, uid, ids, context=context)
 
+    def get_signup_url(self, cr, uid, ids, context=None):
+        assert len(ids) == 1
+        document = self.browse(cr, uid, ids[0], context=context)
+        partner = document.partner_id
+        action = 'portal_sale.portal_action_invoices'
+        partner.signup_prepare()
+        return partner._get_signup_url_for_action(action=action, view_type='form', res_id=document.id)[partner.id]
+
 
 class mail_mail(osv.osv):
     _inherit = 'mail.mail'
diff --git a/addons/portal_sale/portal_sale_data.xml b/addons/portal_sale/portal_sale_data.xml
index f40897f6998..bdf51fd2fe7 100644
--- a/addons/portal_sale/portal_sale_data.xml
+++ b/addons/portal_sale/portal_sale_data.xml
@@ -6,7 +6,7 @@
         <!--Email template -->
         <record id="email_template_edi_sale" model="email.template">
             <field name="name">Sale Order - Send by Email (Portal)</field>
-            <field name="email_from">${object.user_id.email or ''}</field>
+            <field name="email_from">${object.user_id.email or ''|safe}</field>
             <field name="subject">${object.company_id.name} ${object.state in ('draft', 'sent') and 'Quotation' or 'Order'} (Ref ${object.name or 'n/a' })</field>
             <field name="email_recipients">${object.partner_invoice_id.id}</field>
             <field name="model_id" ref="sale.model_sale_order"/>
@@ -16,7 +16,7 @@
             <field name="body_html"><![CDATA[
 <div style="font-family: 'Lucica Grande', Ubuntu, Arial, Verdana, sans-serif; font-size: 12px; color: rgb(34, 34, 34); background-color: rgb(255, 255, 255); ">
 
-    <p>Hello${object.partner_id.name and ' ' or ''}${object.partner_id.name or ''},</p>
+    <p>Hello ${object.partner_id.name or ''},</p>
     
     <p>Here is your ${object.state in ('draft', 'sent') and 'quotation' or 'order confirmation'} from ${object.company_id.name}: </p>
 
@@ -32,38 +32,40 @@
        &nbsp;&nbsp;Your reference: ${object.client_order_ref}<br />
        % endif
        % if object.user_id:
-       &nbsp;&nbsp;Your contact: <a href="mailto:${object.user_id.email or ''}?subject=Order%20${object.name}">${object.user_id.name}</a>
+       &nbsp;&nbsp;Your contact: <a href="mailto:${object.user_id.email or ''|safe}?subject=Order%20${quote(object.name)|safe}">${object.user_id.name}</a>
        % endif
     </p>
 
-    <%
-    action = 'portal_sale.action_quotations_portal' if object.state in ('draft', 'sent') else 'portal_sale.action_orders_portal'
-    object.partner_id.signup_prepare()
-    signup_url = object.partner_id._get_signup_url_for_action(action=action,view_type='form',res_id=object.id)[object.partner_id.id]
-    %>
+    <% set signup_url = object.get_signup_url() %>
     % if signup_url:
     <p>
     You can access this document and pay online via our Customer Portal:
     </p>
         <a style="display:block; width: 150px; height:20px; margin-left: 120px; color: #DDD; font-family: 'Lucida Grande', Helvetica, Arial, sans-serif; font-size: 13px; font-weight: bold; text-align: center; text-decoration: none !important; line-height: 1; padding: 5px 0px 0px 0px; background-color: #8E0000; border-radius: 5px 5px; background-repeat: repeat no-repeat;"
-           href="${signup_url}">View ${object.state in ('draft', 'sent') and 'Quotation' or 'Order'}</a>
+           href="${signup_url|safe}">View ${object.state in ('draft', 'sent') and 'Quotation' or 'Order'}</a>
     % endif
 
     % if object.order_policy in ('prepaid','manual') and object.company_id.paypal_account and object.state != 'draft':
-    <%
-    comp_name = quote(object.company_id.name)
-    order_name = quote(object.name)
-    paypal_account = quote(object.company_id.paypal_account)
-    order_amount = quote(str(object.residual))
-    cur_name = quote(object.pricelist_id.currency_id.name)
-    paypal_url = "https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&amp;business=%s&amp;item_name=%s%%20Order%%20%s" \
-       "&amp;invoice=%s&amp;amount=%s&amp;currency_code=%s&amp;button_subtype=services&amp;no_note=1" \
-       "&amp;bn=OpenERP_Order_PayNow_%s" % \
-       (paypal_account,comp_name,order_name,order_name,order_amount,cur_name,cur_name)
+    <% set paypal_url = ("https://www.paypal.com/cgi-bin/webscr?cmd=_xclick"
+            "&amp;business=%(paypal_account)s"
+            "&amp;item_name=%(company_name)s%%20Order%%20%(order_name)s"
+            "&amp;invoice=%(order_name)s"
+            "&amp;amount=%(order_amount)s"
+            "&amp;currency_code=%(currency)s"
+            "&amp;button_subtype=services"
+            "&amp;no_note=1"
+            "&amp;bn=OpenERP_Order_PayNow_%(currency)s"
+            % {
+                'paypal_account': quote(object.company_id.paypal_account),
+                'company_name': quote(object.company_id.name),
+                'order_name': quote(object.name),
+                'order_amount': quote(str(object.residual)),
+                'currency': quote(object.pricelist_id.currency_id.name),
+            })
     %>
     <br/>
     <p>It is also possible to directly pay with Paypal:</p>
-        <a style="margin-left: 120px;" href="${paypal_url}">
+        <a style="margin-left: 120px;" href="${paypal_url|safe}">
             <img class="oe_edi_paypal_button" src="https://www.paypal.com/en_US/i/btn/btn_paynowCC_LG.gif"/>
         </a>
     % endif
@@ -99,9 +101,9 @@
         % endif
         % if object.company_id.website:
             <div>
-                Web :&nbsp;<a href="${object.company_id.website}">${object.company_id.website}</a>
+                Web :&nbsp;<a href="${object.company_id.website|safe}">${object.company_id.website|safe}</a>
             </div>
-        %endif
+        % endif
         <p></p>
     </div>
 </div>
@@ -110,7 +112,7 @@
 
         <record id="email_template_edi_invoice" model="email.template">
             <field name="name">Invoice - Send by Email (Portal)</field>
-            <field name="email_from">${object.user_id.email or object.company_id.email or 'noreply@localhost'}</field>
+            <field name="email_from">${object.user_id.email or object.company_id.email or 'noreply@localhost'|safe}</field>
             <field name="subject">${object.company_id.name} Invoice (Ref ${object.number or 'n/a' })</field>
             <field name="email_recipients">${object.partner_id.id}</field>
             <field name="model_id" ref="account.model_account_invoice"/>
@@ -120,7 +122,7 @@
             <field name="body_html"><![CDATA[
 <div style="font-family: 'Lucica Grande', Ubuntu, Arial, Verdana, sans-serif; font-size: 12px; color: rgb(34, 34, 34); background-color: rgb(255, 255, 255); ">
 
-    <p>Hello${object.partner_id.name and ' ' or ''}${object.partner_id.name or ''},</p>
+    <p>Hello ${object.partner_id.name or ''},</p>
 
     <p>A new invoice is available for you: </p>
     
@@ -133,15 +135,11 @@
        &nbsp;&nbsp;Order reference: ${object.origin}<br />
        % endif
        % if object.user_id:
-       &nbsp;&nbsp;Your contact: <a href="mailto:${object.user_id.email or ''}?subject=Invoice%20${object.number}">${object.user_id.name}</a>
+       &nbsp;&nbsp;Your contact: <a href="mailto:${object.user_id.email or ''|safe}?subject=Invoice%20${object.number}">${object.user_id.name}</a>
        % endif
     </p>  
 
-    <%
-    action = 'portal_sale.portal_action_invoices'
-    object.partner_id.signup_prepare()
-    signup_url = object.partner_id._get_signup_url_for_action(action=action,view_type='form',res_id=object.id)[object.partner_id.id]
-    %>
+    <% set signup_url = object.get_signup_url() %>
     % if signup_url:
     <p>
     You can access the invoice document and pay online via our Customer Portal:
@@ -151,19 +149,26 @@
     % endif
     
     % if object.company_id.paypal_account and object.type in ('out_invoice'):
-    <% 
-    comp_name = quote(object.company_id.name)
-    inv_number = quote(object.number)
-    paypal_account = quote(object.company_id.paypal_account)
-    inv_amount = quote(str(object.residual))
-    cur_name = quote(object.currency_id.name)
-    paypal_url = "https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&amp;business=%s&amp;item_name=%s%%20Invoice%%20%s&amp;" \
-                 "invoice=%s&amp;amount=%s&amp;currency_code=%s&amp;button_subtype=services&amp;no_note=1&amp;bn=OpenERP_Invoice_PayNow_%s" % \
-                 (paypal_account,comp_name,inv_number,inv_number,inv_amount,cur_name,cur_name)
+    <% set paypal_url = ("https://www.paypal.com/cgi-bin/webscr?cmd=_xclick"
+            "&amp;business=%(paypal_account)s"
+            "&amp;item_name=%(company_name)s%%20Invoice%%20%(inv)s"
+            "&amp;invoice=%(inv)s"
+            "&amp;amount=%(amount)s"
+            "&amp;currency_code=%(currency)s"
+            "&amp;button_subtype=services"
+            "&amp;no_note=1"
+            "&amp;bn=OpenERP_Invoice_PayNow_%(currency)s"
+            % {
+                'paypal_account': quote(object.company_id.paypal_account),
+                'company_name': quote(object.company_id.name),
+                'inv': quote(object.number),
+                'amount': quote(str(object.residual)),
+                'currency': quote(object.currency_id.name),
+            })
     %>
     <br/>
     <p>It is also possible to directly pay with Paypal:</p>
-        <a style="margin-left: 120px;" href="${paypal_url}">
+        <a style="margin-left: 120px;" href="${paypal_url|safe}">
             <img class="oe_edi_paypal_button" src="https://www.paypal.com/en_US/i/btn/btn_paynowCC_LG.gif"/>
         </a>
     % endif
@@ -199,9 +204,9 @@
         % endif
         % if object.company_id.website:
             <div>
-                Web :&nbsp;<a href="${object.company_id.website}">${object.company_id.website}</a>
+                Web :&nbsp;<a href="${object.company_id.website|safe}">${object.company_id.website|safe}</a>
             </div>
-        %endif
+        % endif
         <p></p>
     </div>
 </div>