From a29876f47f6b4e7b5f85b13ce3caef0761b73499 Mon Sep 17 00:00:00 2001
From: Stuart Lynn <stuart.lynn@gmail.com>
Date: Wed, 20 Apr 2016 13:42:13 -0400
Subject: [PATCH] making obs_search a bit more secure

---
 src/pg/sql/42_observatory_exploration.sql | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/pg/sql/42_observatory_exploration.sql b/src/pg/sql/42_observatory_exploration.sql
index fd6961f..b845e85 100644
--- a/src/pg/sql/42_observatory_exploration.sql
+++ b/src/pg/sql/42_observatory_exploration.sql
@@ -3,7 +3,7 @@
 -- TODO allow the user to specify the boundary to search for measures
 --
 
-CREATE OR REPLACE FUNCTION cdb_observatory.OBS_Search(
+CREATE OR REPLACE FUNCTION cdb_observatory.OBS_Search_STU(
   search_term text,
   relevant_boundary text DEFAULT null
 )
@@ -24,10 +24,21 @@ BEGIN
                   aggregate,
                   replace(split_part(id,'".', 1),'"', '') source
                   FROM observatory.OBS_column
-                  where name ilike '%%%s%%'
-                  or description ilike '%%%s%%'
+                  where name ilike '%'|| %L || '%'
+                  or description ilike '%'|| %L || '%'
                   %s
                 $string$, search_term, search_term,boundary_term);
   RETURN;
 END
 $$ LANGUAGE plpgsql;
+
+
+CREATE OR REPLACE FUNCTION OBS_GetAvailableBoundaries(geometry location)
+RETURNS TABLE(description text, name text, id text)  as $$
+BEGIN
+  RETURN QUERY
+  EXECUTE format($string$
+    Select description, name, id FROM observatory.OBS_column
+  $string$)
+END
+$$