SQL Injection fix: Validate sortKey name in order.

Regarding #147, validate sortKey names to be valid MySQL columns based on MySQL's [identifier rules](http://dev.mysql.com/doc/refman/5.0/en/identifiers.html).

Unit tests pass.