From e0aefb84ba0a80b8f845c6ea3c2b7cdbf17b7be9 Mon Sep 17 00:00:00 2001
From: Guangcong Luo <guangcongluo@gmail.com>
Date: Fri, 3 May 2013 01:26:29 -0700
Subject: [PATCH] New function escapeFormat for format names

---
 index.template.html | 2 +-
 js/battledata.js    | 7 +++++++
 js/client-chat.js   | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/index.template.html b/index.template.html
index 2bbbac4bd..71c8fa0bf 100644
--- a/index.template.html
+++ b/index.template.html
@@ -79,7 +79,7 @@
 		</script>
 
 		<script src="//play.pokemonshowdown.com/js/config.js?"></script>
-		<script src="//play.pokemonshowdown.com/js/battledata.js?"></script>
+		<script src="/js/battledata.js"></script>
 		<script src="//play.pokemonshowdown.com/data/pokedex-mini.js?"></script>
 		<script src="//play.pokemonshowdown.com/js/battle.js?"></script>
 		<script src="//play.pokemonshowdown.com/js/sockjs-0.3.min.js"></script>
diff --git a/js/battledata.js b/js/battledata.js
index 04ed68441..1ce6571cf 100644
--- a/js/battledata.js
+++ b/js/battledata.js
@@ -353,6 +353,13 @@ var Tools = {
 		return Tools.resolveAvatar(sprites[Math.floor(Math.random() * sprites.length)]);
 	},
 
+	escapeFormat: function(formatid) {
+		if (window.BattleFormats && BattleFormats[formatid]) {
+			return Tools.escapeHTML(BattleFormats[formatid].name)
+		}
+		return Tools.escapeHTML(formatid);
+	},
+
 	escapeHTML: function(str, jsEscapeToo) {
 		str = (str?''+str:'');
 		str = str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
diff --git a/js/client-chat.js b/js/client-chat.js
index a8cd7e5d3..292c4267a 100644
--- a/js/client-chat.js
+++ b/js/client-chat.js
@@ -185,7 +185,7 @@
 					if (!matches) {
 						return; // bogus room ID could be used to inject JavaScript
 					}
-					var format = (matches ? matches[1] : '');
+					var format = Tools.escapeFormat(matches ? matches[1] : '');
 
 					if (silent && !Tools.prefs('showbattles')) return;