Use static column name insertion

Otherwise we end up trying to ORDER BY "is_admin", the literal string.

1 files changed, 3 insertions, 2 deletions

diff --git a/synapse/storage/_base.py b/synapse/storage/_base.py

index 35ded73f25..73a66e28b0 100644
--- a/synapse/storage/_base.py
+++ b/synapse/storage/_base.py
@@ -670,8 +670,9 @@ class SQLBaseStore(object):
             )
 
         if order:
-            sql = sql + " ORDER BY ? %s" % ("ASC" if order_asc else "DESC")
-            query_values.append(order)
+            sql = sql + " ORDER BY %s %s" % (
+                order, "ASC" if order_asc else "DESC"
+            )
 
         txn.execute(sql, query_values)