X-Git-Url: https://git.openstreetmap.org./nominatim.git/blobdiff_plain/d4b633bfc50188f36e3c4a8b2b99c3a0e6a7f12e..33ff96fd8323040f4551839e55c061b048329f66:/website/details.php

diff --git a/website/details.php b/website/details.php
index c64eaa45..cb371e6b 100644
--- a/website/details.php
+++ b/website/details.php
@@ -31,17 +31,13 @@ $oDB->connect();
 $sLanguagePrefArraySQL = $oDB->getArraySQL($oDB->getDBQuotedList($aLangPrefOrder));
 
 if ($sOsmType && $iOsmId > 0) {
-    $sSQL = sprintf(
-        "SELECT place_id FROM placex WHERE osm_type='%s' AND osm_id=%d",
-        $sOsmType,
-        $iOsmId
-    );
+    $sSQL = 'SELECT place_id FROM placex WHERE osm_type = :type AND osm_id = :id';
     // osm_type and osm_id are not unique enough
     if ($sClass) {
         $sSQL .= " AND class='".$sClass."'";
     }
     $sSQL .= ' ORDER BY class ASC';
-    $sPlaceId = chksql($oDB->getOne($sSQL));
+    $sPlaceId = $oDB->getOne($sSQL, array(':type' => $sOsmType, ':id' => $iOsmId));
 
     // Be nice about our error messages for broken geometry
 
@@ -56,11 +52,11 @@ if ($sOsmType && $iOsmId > 0) {
         $sSQL .= '    ST_AsText(prevgeometry) AS prevgeom, ';
         $sSQL .= '    ST_AsText(newgeometry) AS newgeom';
         $sSQL .= ' FROM import_polygon_error ';
-        $sSQL .= " WHERE osm_type = '".$sOsmType."'";
-        $sSQL .= '  AND osm_id = '.$iOsmId;
+        $sSQL .= ' WHERE osm_type = :type';
+        $sSQL .= '   AND osm_id = :id';
         $sSQL .= ' ORDER BY updated DESC';
         $sSQL .= ' LIMIT 1';
-        $aPointDetails = chksql($oDB->getRow($sSQL));
+        $aPointDetails = $oDB->getRow($sSQL, array(':type' => $sOsmType, ':id' => $iOsmId));
         if ($aPointDetails) {
             if (preg_match('/\[(-?\d+\.\d+) (-?\d+\.\d+)\]/', $aPointDetails['errormessage'], $aMatches)) {
                 $aPointDetails['error_x'] = $aMatches[1];
@@ -81,20 +77,20 @@ if ($sPlaceId === false) userError('Please select a place id');
 $iPlaceID = (int)$sPlaceId;
 
 if (CONST_Use_US_Tiger_Data) {
-    $iParentPlaceID = chksql($oDB->getOne('SELECT parent_place_id FROM location_property_tiger WHERE place_id = '.$iPlaceID));
+    $iParentPlaceID = $oDB->getOne('SELECT parent_place_id FROM location_property_tiger WHERE place_id = '.$iPlaceID);
     if ($iParentPlaceID) $iPlaceID = $iParentPlaceID;
 }
 
 // interpolated house numbers
-$iParentPlaceID = chksql($oDB->getOne('SELECT parent_place_id FROM location_property_osmline WHERE place_id = '.$iPlaceID));
+$iParentPlaceID = $oDB->getOne('SELECT parent_place_id FROM location_property_osmline WHERE place_id = '.$iPlaceID);
 if ($iParentPlaceID) $iPlaceID = $iParentPlaceID;
 
 // artificial postcodes
-$iParentPlaceID = chksql($oDB->getOne('SELECT parent_place_id FROM location_postcode WHERE place_id = '.$iPlaceID));
+$iParentPlaceID = $oDB->getOne('SELECT parent_place_id FROM location_postcode WHERE place_id = '.$iPlaceID);
 if ($iParentPlaceID) $iPlaceID = $iParentPlaceID;
 
 if (CONST_Use_Aux_Location_data) {
-    $iParentPlaceID = chksql($oDB->getOne('SELECT parent_place_id FROM location_property_aux WHERE place_id = '.$iPlaceID));
+    $iParentPlaceID = $oDB->getOne('SELECT parent_place_id FROM location_property_aux WHERE place_id = '.$iPlaceID);
     if ($iParentPlaceID) $iPlaceID = $iParentPlaceID;
 }
 
@@ -129,7 +125,7 @@ if ($bIncludePolygonAsGeoJSON) {
 $sSQL .= ' FROM placex ';
 $sSQL .= " WHERE place_id = $iPlaceID";
 
-$aPointDetails = chksql($oDB->getRow($sSQL), 'Could not get details of place object.');
+$aPointDetails = $oDB->getRow($sSQL, null, 'Could not get details of place object.');
 
 if (!$aPointDetails) {
     userError('Unknown place id.');
@@ -224,11 +220,17 @@ if ($bIncludeKeywords) {
     $aPlaceSearchName = $oDB->getRow($sSQL);
 
     if (!empty($aPlaceSearchName)) {
-        $sSQL = 'SELECT * FROM word WHERE word_id in ('.substr($aPlaceSearchName['name_vector'], 1, -1).')';
-        $aPlaceSearchNameKeywords = $oDB->getAll($sSQL);
+        $sWordIds = substr($aPlaceSearchName['name_vector'], 1, -1);
+        if (!empty($sWordIds)) {
+            $sSQL = 'SELECT * FROM word WHERE word_id in ('.$sWordIds.')';
+            $aPlaceSearchNameKeywords = $oDB->getAll($sSQL);
+        }
 
-        $sSQL = 'SELECT * FROM word WHERE word_id in ('.substr($aPlaceSearchName['nameaddress_vector'], 1, -1).')';
-        $aPlaceSearchAddressKeywords = $oDB->getAll($sSQL);
+        $sWordIds = substr($aPlaceSearchName['nameaddress_vector'], 1, -1);
+        if (!empty($sWordIds)) {
+            $sSQL = 'SELECT * FROM word WHERE word_id in ('.$sWordIds.')';
+            $aPlaceSearchAddressKeywords = $oDB->getAll($sSQL);
+        }
     }
 }
 
@@ -236,7 +238,7 @@ logEnd($oDB, $hLog, 1);
 
 if ($sOutputFormat=='html') {
     $sSQL = "SELECT TO_CHAR(lastimportdate,'YYYY/MM/DD HH24:MI')||' GMT' FROM import_status LIMIT 1";
-    $sDataDate = chksql($oDB->getOne($sSQL));
+    $sDataDate = $oDB->getOne($sSQL);
     $sTileURL = CONST_Map_Tile_URL;
     $sTileAttribution = CONST_Map_Tile_Attribution;
 }