    public function showByTitle() {
        expHistory::set('viewable', $this->params);
        $modelname = $this->basemodel_name;
        // first we'll check to see if this matches the sef_url field...if not then we'll look for the
        // title field
        $this->params['title'] = expString::escape($this->params['title']);  // escape title to prevent sql injection
        $record = $this->$modelname->find('first', "sef_url='" . $this->params['title'] . "'");
        if (!is_object($record)) {
            $record = $this->$modelname->find('first', "title='" . $this->params['title'] . "'");
        }
        $this->loc = unserialize($record->location_data);

        assign_to_template(array(
            'record' => $record,
        ));
    }
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.