Fix injection vulnerability

From the incorrect assumption that BattleFormats was sanatised