diff --git a/webht/third_party/paypal/models/note_model.php b/webht/third_party/paypal/models/note_model.php
index a893707c..ba8820ce 100644
--- a/webht/third_party/paypal/models/note_model.php
+++ b/webht/third_party/paypal/models/note_model.php
@@ -101,7 +101,8 @@ class Note_model extends CI_Model {
         $sql .= "
                     pn.pn_sn
                   ,pn.pn_txn_id
-                  ,pn.pn_invoice
+                  --,pn.pn_invoice
+                  ,replace(replace(pn.pn_invoice,char(13),' '),char(10),' ') pn_invoice
                   ,pn.pn_custom
                   ,pn.pn_mc_gross
                   ,pn.pn_item_name
diff --git a/webht/third_party/paypal/views/note_list.php b/webht/third_party/paypal/views/note_list.php
index 5ff8bda8..e592aa80 100644
--- a/webht/third_party/paypal/views/note_list.php
+++ b/webht/third_party/paypal/views/note_list.php
@@ -196,7 +196,7 @@ echo "<option value=\"$vf->TEL_SN@" . strstr($vf->TEL_transactionDate, " ", true
                     <li class="col-sm-1 nopadding-L" style="overflow:hidden;word-break: break-all;height: 25px;"><?php echo ($key + 1); ?></li>
                     <li class="col-sm-7 nopadding-L" style="overflow:hidden;word-break: break-all;height: 25px;">
                         <a class="seen" target="_blank" href="<?php echo site_url('apps/paypal/index/detail_ht/' . $item->pn_txn_id); ?>">
-                            <?php echo $item->pn_invoice . ' / ' . $item->pn_mc_gross . $item->pn_mc_currency . ' / ' . $item->pn_payer; ?>
+                            <?php echo htmlentities($item->pn_invoice) . ' / ' . $item->pn_mc_gross . $item->pn_mc_currency . ' / ' . $item->pn_payer; ?>
                         </a></li>
 
                     <li class="col-sm-4 nopadding-L" style="overflow:hidden;word-break: break-all;height: 25px;"><?php echo $item->pn_payer_email; ?></li>
@@ -221,7 +221,7 @@ echo "<option value=\"$vf->TEL_SN@" . strstr($vf->TEL_transactionDate, " ", true
                             $class_css = 'btn-danger';
                             $show_send = $item->pn_payment_status ? $item->pn_payment_status : $raw_content->txn_type;
                         }
-                        ?><a href="javascript:void(0);" onclick="show_order_modal('<?php echo $item->pn_txn_id; ?>', '<?php echo $item->pn_sn; ?>', '<?php echo $item->pn_invoice; ?>')" class="btn btn-sm <?php echo $class_css; ?>"><?php echo $show_send; ?></a>
+                        ?><a href="javascript:void(0);" onclick="show_order_modal('<?php echo $item->pn_txn_id; ?>', '<?php echo $item->pn_sn; ?>')" class="btn btn-sm <?php echo $class_css; ?>"><?php echo $show_send; ?></a>
                         <br class="hidden-xs">
                           <a href="javascript:void(0);" class="text_padding text-primary" style="padding: 10px;"
                             onclick="show_gai_modal('<?php echo $item->pn_txn_id; ?>','<?php echo $item->pn_sn; ?>')"
@@ -335,11 +335,11 @@ echo "<option value=\"$vf->TEL_SN@" . strstr($vf->TEL_transactionDate, " ", true
         });
     }
 
-    function show_order_modal(pn_txn_id, pn_id, pn_invoice) {
+    function show_order_modal(pn_txn_id, pn_id) {
         $.ajax({
             type: "get",
             dataType: "json",
-            url: '<?php echo site_url('apps/paypal/index/note_modal/'); ?>' + '/' + pn_txn_id + '/' + pn_id + '/' + pn_invoice,
+            url: '<?php echo site_url('apps/paypal/index/note_modal/'); ?>' + '/' + pn_txn_id + '/' + pn_id,
             success: function(data, textStatus) {
                 $('#modal_set_orderid_body').html(data);
                 $('#modal_set_orderid').modal('show');