Fix XSS Vulnerability In "tpl.inc.php"

Fix applied to where the value is directly output to browser instead of where fetched in case special chars are allowed in `code_name`, which may break logic prior to output.