diff --git a/sp/src/game/server/logicentities.cpp b/sp/src/game/server/logicentities.cpp
index 0d6bb006..2445f875 100644
--- a/sp/src/game/server/logicentities.cpp
+++ b/sp/src/game/server/logicentities.cpp
@@ -4059,7 +4059,7 @@ void CLogicFormat::FormatString(const char *szStringToFormat, char *szOutput, in
 			curparam = atoi(szToken);
 			if (curparam < MAX_LOGIC_FORMAT_PARAMETERS /*&& szParameters[curparam] != NULL*/) //if (curparam < MAX_FORMAT_PARAMETERS)
 			{
-				Q_snprintf(szFormatted, sizeof(szFormatted), "%s%s", szFormatted, szParameters[curparam]);
+				Q_strncat(szFormatted, szParameters[curparam], sizeof(szFormatted));
 			}
 			else
 			{
@@ -4068,8 +4068,8 @@ void CLogicFormat::FormatString(const char *szStringToFormat, char *szOutput, in
 				// This might not be the best way to do this, but
 				// reaching it is supposed to be the result of a mistake anyway.
 				m_iszBackupParameter != NULL_STRING ?
-					Q_snprintf(szFormatted, sizeof(szFormatted), "%s%s", szFormatted, STRING(m_iszBackupParameter)) :
-					Q_snprintf(szFormatted, sizeof(szFormatted), "%s<null>", szFormatted);
+					Q_strncat( szFormatted, STRING(m_iszBackupParameter), sizeof( szFormatted ) ) :
+					Q_strncat( szFormatted, "<null>", sizeof( szFormatted ) );
 			}
 
 			inparam = false;
@@ -4077,7 +4077,7 @@ void CLogicFormat::FormatString(const char *szStringToFormat, char *szOutput, in
 		}
 		else
 		{
-			Q_snprintf(szFormatted, sizeof(szFormatted), "%s%s", szFormatted, szToken);
+			Q_strncat( szFormatted, szToken, sizeof( szFormatted ) );
 
 			inparam = true;
 			szToken = strtok(NULL, "}");
diff --git a/sp/src/game/server/maprules.cpp b/sp/src/game/server/maprules.cpp
index 91049ad8..60279244 100644
--- a/sp/src/game/server/maprules.cpp
+++ b/sp/src/game/server/maprules.cpp
@@ -447,7 +447,8 @@ void CGameText::SetText( const char* pszStr )
 
 		for (int i = 1; i < vecLines.Count(); i++)
 		{
-			Q_snprintf( szMsg, sizeof( szMsg ), "%s\n%s", szMsg, vecLines[i] );
+			Q_strncat( szMsg, "\n", sizeof( szMsg ) );
+			Q_strncat( szMsg, vecLines[i], sizeof( szMsg ) );
 		}
 		m_iszMessage = AllocPooledString( szMsg );
 	}