Content Security Policy(CSP) is an incremental layer of security which can be used to mitigate XSS and data injection attack. Note that CSP only provides added security. It is not the primary way to defend against XSS. Using CSP , server admin can specify valid sources of executable scripts. and hence reducing the risk of XSS attack. 
 

How to enable CSP

  1. The webserver must return the Content-Security-Policy HTTP header.
  2. For example Content-Security-Policy: script-src https://clariyforme.com/ will allow scripts to be downloaded only from clarifyforme.com and will block 
    1. <script src="https://not-clarifyforme.com/jslib.js"></script>
    2. inline scripts within scrip tag, for instance 
      <script>
let j = 0;
//javascript code
</script>
    3. inline event handlers , for instance 
      <img id="img1"onclick="someAction()">
    4. If unsafe-eval is not specified with script-src then following methods will be blocked
      1. eval() and similar methods that provide string -> code interpretation are disabled by default when CSP is enabled.
      2. passing string literal to methods like
        1. setTimeout("alert(\"This will be blocked!\");", 1000);
        2. setInterval
Note that since inline event scripts and inline event handlers are blocked the script code has to be placed in js files and inline event handlers should be replaced with addEventLisnter in the js file. eg  
document.getElementById("img1").addEventListener('click', someAction());
 
Since inline scripts can be blocked with CSP hence there is no question of a variable with user input being present in scripts.