sprintf() used to build DB queries

[madmatt]

This is not specifically a security issue, but ideally can be fixed so that it doesn't ever become a security issue. There a few places where sprintf() is used to build a SQL query that could be built more appropriately with the new DB::prepared_query() or using SQLUpdate etc.

Examples:

• https://github.com/silverstripe-australia/silverstripe-gridfieldextensions/blob/50ffec51e4c1d5a0a01fd1ae8bb6df00cbfd7c99/code/GridFieldOrderableRows.php#L474
• https://github.com/silverstripe-australia/silverstripe-gridfieldextensions/blob/50ffec51e4c1d5a0a01fd1ae8bb6df00cbfd7c99/code/GridFieldOrderableRows.php#L509
• https://github.com/silverstripe-australia/silverstripe-gridfieldextensions/blob/50ffec51e4c1d5a0a01fd1ae8bb6df00cbfd7c99/code/GridFieldOrderableRows.php#L512