Fix security issue when updating order by API.

Fixes #5711