From 19b8532d55bb35d3d471bbe859e5ca080e85324f Mon Sep 17 00:00:00 2001
From: Mattias Michaux <mattias.michaux@gmail.com>
Date: Tue, 26 Apr 2016 14:11:55 +0200
Subject: [PATCH] Adapted CRM_Utils_Sort code to use the validation and
 escaping.

---
 CRM/Utils/Sort.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/CRM/Utils/Sort.php b/CRM/Utils/Sort.php
index 1801f97a4e..789dba32d6 100644
--- a/CRM/Utils/Sort.php
+++ b/CRM/Utils/Sort.php
@@ -121,7 +121,7 @@ class CRM_Utils_Sort {
 
     foreach ($vars as $weight => $value) {
       $this->_vars[$weight] = array(
-        'name' => $value['sort'],
+        'name' => CRM_Utils_Type::validate($value['sort'], 'MysqlColumnName'),
         'direction' => CRM_Utils_Array::value('direction', $value),
         'title' => $value['name'],
       );
@@ -152,11 +152,11 @@ class CRM_Utils_Sort {
       $this->_vars[$this->_currentSortID]['direction'] == self::DONTCARE
     ) {
       $this->_vars[$this->_currentSortID]['name'] = str_replace(' ', '_', $this->_vars[$this->_currentSortID]['name']);
-      return $this->_vars[$this->_currentSortID]['name'] . ' asc';
+      return CRM_Utils_Type::validate($this->_vars[$this->_currentSortID]['name'], 'MysqlColumnName') . ' asc';
     }
     else {
       $this->_vars[$this->_currentSortID]['name'] = str_replace(' ', '_', $this->_vars[$this->_currentSortID]['name']);
-      return $this->_vars[$this->_currentSortID]['name'] . ' desc';
+      return CRM_Utils_Type::validate($this->_vars[$this->_currentSortID]['name'], 'MysqlColumnName') . ' desc';
     }
   }
 
-- 
2.25.1