Fix more XSS in battle.js