Fix injection vulnerability in tournaments

From the incorrect assumption that `BattleFormats` was sanatised