updated getLocations ajax code to do some basic escaping
Get locations related to tour ajax call, and tour from id ajax call