sanitize returns fields as 2nd parameter

The method now returns a new array with only the elements allowed by $fields param.
Useful for ORM or active record: the sanitized array must contain only keys that match table columns.