dadooda/handles_sortable_columns — pull request #5 by alexspeller (2012-04-23 17:36:54+00:00)
Title: Security hole

Your example in the readme has a security hole, you can specify any sort order and therefore run arbitrary SQL.

This approach is safer, might be better with DSL support e.g.

```ruby
handles_sortable_columns 'name', 'product'
```