--- a/busui/tripPlanner.php
+++ b/busui/tripPlanner.php
@@ -1,14 +1,16 @@
 <?php
   include('common.inc.php');
   include_header("Trip Planner", true, true);
+  $from = (isset($_REQUEST['from']) ? filter_var($_REQUEST['from'],FILTER_SANITIZE_STRING) : "Brigalow");
+      $to = (isset($_REQUEST['to']) ? filter_var($_REQUEST['to'],FILTER_SANITIZE_STRING) : "Barry");
+      $date = (isset($_REQUEST['date']) ? filter_var($_REQUEST['date'],FILTER_SANITIZE_STRING) : date("m/d/Y"));
+      $time = (isset($_REQUEST['time']) ? filter_var($_REQUEST['time'],FILTER_SANITIZE_STRING) : date("H:m"));
+      # todo: convert date from form to h:ia?
+
   function tripPlanForm($errorMessage = "")
   {
-      $from = (isset($_REQUEST['from']) ? $_REQUEST['from'] : "Brigalow");
-      $to = (isset($_REQUEST['to']) ? $_REQUEST['to'] : "Barry");
-      $date = (isset($_REQUEST['date']) ? $_REQUEST['date'] : date("m/d/Y"));
-      $time = (isset($_REQUEST['time']) ? $_REQUEST['time'] : date("H:m"));
-      # todo: convert date from form to h:ia?
-      echo "<font color=red>$errorMessage</font>";
+    global $date,$time,$from,$to;
+            echo "<font color=red>$errorMessage</font>";
       echo '<form action="tripPlanner.php" method="post">
     <div data-role="fieldcontain">
         <label for="from">I would like to go from</label>
@@ -86,17 +88,17 @@
   }
   
   if ($_REQUEST['time']) {
-      $toPlace = (startsWith($_REQUEST['to'], "-") ? $_REQUEST['to'] : geocode(urlencode($_REQUEST['to']), false));
-      $fromPlace = (startsWith($_REQUEST['from'], "-") ? $_REQUEST['from'] : geocode(urlencode($_REQUEST['from']), false));
+      $toPlace = (startsWith($to, "-") ? $to : geocode($to, false));
+      $fromPlace = (startsWith($from, "-") ? $from : geocode($from, false));
       if ($toPlace == "" || $fromPlace == "") {
           $errorMessage = "";
           if ($toPlace === "")
-              $errorMessage .= urlencode($_REQUEST['to']) . " not found.<br>\n";
+              $errorMessage .= urlencode($to) . " not found.<br>\n";
           if ($fromPlace === "")
-              $errorMessage .= urlencode($_REQUEST['from']) . " not found.<br>\n";
+              $errorMessage .= urlencode($from) . " not found.<br>\n";
           tripPlanForm($errorMessage);
       } else {
-          $url = "http://10.1.0.243:5080/opentripplanner-api-webapp/ws/plan?_dc=1290254798856&arriveBy=false&date=" . urlencode($_REQUEST['date']) . "&time=" . urlencode($_REQUEST['time']) . "&mode=TRANSIT%2CWALK&optimize=QUICK&maxWalkDistance=840&wheelchair=false&toPlace=$toPlace&fromPlace=$fromPlace&intermediatePlaces=";
+          $url = $otpAPIurl."ws/plan?date=" . urlencode($_REQUEST['date']) . "&time=" . urlencode($_REQUEST['time']) . "&mode=TRANSIT%2CWALK&optimize=QUICK&maxWalkDistance=840&wheelchair=false&toPlace=$toPlace&fromPlace=$fromPlace&intermediatePlaces=";
           $ch = curl_init($url);
           curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
           curl_setopt($ch, CURLOPT_HEADER, 0);