Fix SQL Injection in function orderby_sql()