Instead of escaping the incoming sql, I have implemented :order value checking to
ensure that any column specified as the ordering column actually exists on the model
object. Note: this implementation expects a single order value rather than primary,
secondary, tertiary, ...etc. Also, it expects to have a single model to check the
columns on. These assumptions fit a very high percentage of our :order usage.
Task #2427 Escape sql chunks against sql injection
The :conditions are parameterized, but the :order clauses need to be processed
to guard against sql injection. There are a couple of approaches to do th