correctly quote display name in html search result

[nominatim.git] / lib / template / search-html.php

diff --git a/lib/template/search-html.php b/lib/template/search-html.php
index b270e02fb9a2bfdb8fd5dcd2f01126fd91283d87..7da79ad82a07180d0fe57d6ad8d6abd674c8fff5 100644 (file)
--- a/lib/template/search-html.php
+++ b/lib/template/search-html.php
@@ -199,11 +199,13 @@ target="_blank">FAQ</a></td>
                }
 
                echo (isset($aResult['icon'])?'<img alt="icon" src="'.$aResult['icon'].'"/>':'');
-               echo ' <span class="name">'.$aResult['name'].'</span>';
+               echo ' <span class="name">'.htmlspecialchars($aResult['name']).'</span>';
                echo ' <span class="latlon">'.round($aResult['lat'],3).','.round($aResult['lon'],3).'</span>';
                echo ' <span class="place_id">'.$aResult['place_id'].'</span>';
                if (isset($aResult['label']))
                        echo ' <span class="type">('.$aResult['label'].')</span>';
+               else if ($aResult['type'] == 'yes')
+                       echo ' <span class="type">('.ucwords(str_replace('_',' ',$aResult['class'])).')</span>';
                else
                        echo ' <span class="type">('.ucwords(str_replace('_',' ',$aResult['type'])).')</span>';
                echo ' <span class="details">(<a href="details.php?place_id='.$aResult['place_id'].'">details</a>)</span>';