Add escaping of template code

Author: jissereitsma

view/base/templates/script/variables.phtml

@@ -18,7 +18,7 @@ if (!is_numeric($mobileWidth) || $mobileWidth < 100) {
 ?>
 <script>
     var LOKI_BASE_URL = '<?= $escaper->escapeUrl($block->getBaseUrl()) ?>';
-    var LOKI_FORM_KEY = '<?= /* @noEscape */ $formKeyValue->get() ?>';
+    var LOKI_FORM_KEY = '<?= $escaper->escapeHtml($formKeyValue->get()) ?>';
     var LOKI_CURRENT_URL = window.location.href.split('?')[0];
     var LOKI_IS_MOBILE = ((window.innerWidth > 0) ? window.innerWidth : screen.width) < <?= (int)$mobileWidth ?>; // @todo: What happens if you change browser width on the fly?
 </script>