properly escape class parameter

[nominatim.git] / website / details.php

diff --git a/website/details.php b/website/details.php
index cb371e6b09d2cd8d3e21d463731dce8dea552820..6f7c807d88d58890ec235ec0f519833a7c2ca0c1 100644 (file)
--- a/website/details.php
+++ b/website/details.php
@@ -30,14 +30,31 @@ $oDB->connect();
 
 $sLanguagePrefArraySQL = $oDB->getArraySQL($oDB->getDBQuotedList($aLangPrefOrder));
 
+if ($sOutputFormat == 'html' && !$sPlaceId && !$sOsmType) {
+    include(CONST_BasePath.'/lib/template/details-index-html.php');
+    exit;
+}
+
 if ($sOsmType && $iOsmId > 0) {
     $sSQL = 'SELECT place_id FROM placex WHERE osm_type = :type AND osm_id = :id';
+    $aSQLParams = array(':type' => $sOsmType, ':id' => $iOsmId);
     // osm_type and osm_id are not unique enough
     if ($sClass) {
-        $sSQL .= " AND class='".$sClass."'";
+        $sSQL .= ' AND class= :class';
+        $aSQLParams[':class'] = $sClass;
     }
     $sSQL .= ' ORDER BY class ASC';
-    $sPlaceId = $oDB->getOne($sSQL, array(':type' => $sOsmType, ':id' => $iOsmId));
+    $sPlaceId = $oDB->getOne($sSQL, $aSQLParams);
+
+
+    // Nothing? Maybe it's an interpolation.
+    // XXX Simply returns the first parent street it finds. It should
+    //     get a house number and get the right interpolation.
+    if (!$sPlaceId && $sOsmType == 'W' && (!$sClass || $sClass == 'place')) {
+        $sSQL = 'SELECT place_id FROM location_property_osmline'
+                .' WHERE osm_id = :id LIMIT 1';
+        $sPlaceId = $oDB->getOne($sSQL, array(':id' => $iOsmId));
+    }
 
     // Be nice about our error messages for broken geometry