mirror of
https://github.com/osm-search/Nominatim.git
synced 2026-02-14 10:27:57 +00:00
The subsequent INSERT is done on an unqouted table name, making in theory an SQL injection through an OSM value possible. In practise this cannot happen because we check for the existance of the table. During the creation of the classtype tables there is a sanity check in place to disallow any table names that consist of anything other than alphanumeric characters.