diff --git a/install-dev/upgrade/php/update_order_messages.php b/install-dev/upgrade/php/update_order_messages.php
index 369b753d5..29d4cc07e 100644
--- a/install-dev/upgrade/php/update_order_messages.php
+++ b/install-dev/upgrade/php/update_order_messages.php
@@ -29,17 +29,18 @@ function update_order_messages()
 	$step = 3000;
 	$count_messages = Db::getInstance()->getValue('SELECT count(id_message) FROM '._DB_PREFIX_.'message');
 	$nb_loop = $start = 0;
+	$pattern = '<br|&[a-zA-Z]{1,8};';
 	if($count_messages > 0)
 		$nb_loop = ceil($count_messages / $step);
 	for($i = 0; $i < $nb_loop; $i++)
 	{
-		$sql = 'SELECT id_message, message FROM `'._DB_PREFIX_.'message` WHERE message REGEXP \'<br|&[^;]{1,8}\' LIMIT '.(int)$start.', '.(int)$step;
+		$sql = 'SELECT id_message, message FROM `'._DB_PREFIX_.'message` WHERE message REGEXP \''.pSQL($pattern, true).'\' LIMIT '.(int)$start.', '.(int)$step;
 		if ($messages = Db::getInstance()->query($sql))
 			while ($message = Db::getInstance()->nextRow($messages))
 			{
 				if(is_array($message))
 				{
-					$sql = 'UPDATE `'._DB_PREFIX_.'message` SET message = \''.pSQL(Tools::htmlentitiesDecodeUTF8(br2nl($message['message']))).'\' 
+					$sql = 'UPDATE `'._DB_PREFIX_.'message` SET message = \''.pSQL(preg_replace('/'.$pattern.'/', '', Tools::htmlentitiesDecodeUTF8(br2nl($message['message'])))).'\' 
 							WHERE id_message = '.(int)$message['id_message'];
 					$result = Db::getInstance()->execute($sql);
 				}
@@ -50,13 +51,13 @@ function update_order_messages()
 		$nb_loop = ceil($count_messages / $step);
 	for($i = 0; $i < $nb_loop; $i++)
 	{
-		$sql = 'SELECT id_customer_message, message FROM `'._DB_PREFIX_.'customer_message` WHERE message REGEXP \'<br|&[^;]{1,8}\' LIMIT '.(int)$start.', '.(int)$step;
+		$sql = 'SELECT id_customer_message, message FROM `'._DB_PREFIX_.'customer_message` WHERE message REGEXP \''.pSQL($pattern, true).'\' LIMIT '.(int)$start.', '.(int)$step;
 		if ($messages = Db::getInstance()->query($sql))
 			while ($message = Db::getInstance()->nextRow($messages))
 			{
 				if(is_array($message))
 				{				
-					$sql = 'UPDATE `'._DB_PREFIX_.'customer_message` SET message = \''.pSQL(Tools::htmlentitiesDecodeUTF8(str_replace('&amp;', '&', $message['message']))).'\' 
+					$sql = 'UPDATE `'._DB_PREFIX_.'customer_message` SET message = \''.pSQL(preg_replace('/'.$pattern.'/', '', Tools::htmlentitiesDecodeUTF8(str_replace('&amp;', '&', $message['message'])))).'\' 
 							WHERE id_customer_message = '.(int)$message['id_customer_message'];
 					Db::getInstance()->execute($sql);
 				}