Fix XSS Vulnerability In "tpl.inc.php"

Fix applied to where the value is directly output to browser instead of where fetched in case special chars are allowed in `code_name`, which may break logic prior to output.

include/staff/tpl.inc.php

@@ -77,7 +77,7 @@ $tpl=$msgtemplates[$selected];
 <form action="templates.php?id=<?php echo $id; ?>&amp;a=manage" method="post" id="save">
 <?php csrf_token(); ?>
 <?php foreach ($extras as $k=>$v) { ?>
-    <input type="hidden" name="<?php echo $k; ?>" value="<?php echo $v; ?>" />
+    <input type="hidden" name="<?php echo $k; ?>" value="<?php echo Format::htmlchars($v); ?>" />
 <?php } ?>
 <input type="hidden" name="id" value="<?php echo $id; ?>">
 <input type="hidden" name="a" value="manage">