properly escape class parameter

[nominatim.git] / website / reverse.php

diff --git a/website/reverse.php b/website/reverse.php
index e1a1b672ad928d82a11e05ad11217c98ef10c4ad..7b9ef3b3b264c71e5ae894f3e5348a49be9ea84a 100644 (file)
--- a/website/reverse.php
+++ b/website/reverse.php
@@ -75,13 +75,16 @@ if (CONST_Debug) {
 }
 
 if ($sOutputFormat == 'html') {
-    $sDataDate = chksql($oDB->getOne("select TO_CHAR(lastimportdate,'YYYY/MM/DD HH24:MI')||' GMT' from import_status limit 1"));
+    $sDataDate = $oDB->getOne("select TO_CHAR(lastimportdate,'YYYY/MM/DD HH24:MI')||' GMT' from import_status limit 1");
     $sTileURL = CONST_Map_Tile_URL;
     $sTileAttribution = CONST_Map_Tile_Attribution;
 } elseif ($sOutputFormat == 'geocodejson') {
     $sQuery = $fLat.','.$fLon;
     if (isset($aPlace['place_id'])) {
-        $fDistance = chksql($oDB->getOne('SELECT ST_Distance(ST_SetSRID(ST_Point('.$fLon.','.$fLat.'),4326), centroid) FROM placex where place_id='.$aPlace['place_id']));
+        $fDistance = $oDB->getOne(
+            'SELECT ST_Distance(ST_SetSRID(ST_Point(:lon,:lat),4326), centroid) FROM placex where place_id = :placeid',
+            array(':lon' => $fLon, ':lat' => $fLat, ':placeid' => $aPlace['place_id'])
+        );
     }
 }