Followup to #1252:

The fix didn't account for custom fields and resulted sql error in case of invalid input, which resulted a 500 page.

The new fix, field is validated against the list from the adv_search template only when not using custom fields:

• eventum/templates/adv_search.tpl.html

  Lines 155 to 162 in 81fbd07

  	<label>{t}Sort By{/t}<br />
  	<select name="sort_by">
  	<option value="last_action_date" {if $options.cst_sort_by|default:'' == "last_action_date"}selected{/if}>{t}Last Action Date{/t}</option>
  	<option value="pri_rank" {if $options.cst_sort_by|default:'' == "pri_rank"}selected{/if}>{t}Priority{/t}</option>
  	<option value="iss_id" {if $options.cst_sort_by|default:'' == "iss_id"}selected{/if}>{t}Issue ID{/t}</option>
  	<option value="sta_rank" {if $options.cst_sort_by|default:'' == "sta_rank"}selected{/if}>{t}Status{/t}</option>
  	<option value="iss_summary" {if $options.cst_sort_by|default:'' == "iss_summary"}selected{/if}>{t}Summary{/t}</option>
  	</select>

Also, the $sort_by is now escaped with quoteIdentifier (method for columns) rather escape (method for values)