Fix SQL error when sorting by custom field containing special char

Incorrect behavior is due to unnecessarily escaping of special chars by
calling db_prepare_string() on the custom field's name before attempting
to retrieve it's id with custom_field_get_id_from_name(). This causes a
double-escaping which prevents a match.

Even though this is not strictly necessary to fix the issue at hand,
this commit also replaces db_query() call by db_query_bound() in
custom_field_get_id_from_name().

Fixes 0012170