SQL injection fix

Check the sort field name against the object before passing it into the query.