Hello. I got this error. Will you fix it?
https://prnt.sc/i89unx

Hey,

$sql .= ' ORDER BY ' . esc_sql( $_REQUEST['orderby'] ); $sql .= ! empty( $_REQUEST['order'] ) ? ' ' . esc_sql( $_REQUEST['order'] ) : ' ASC';

I think this is vulnerable to SQL injection via the method outlined here: [http://josephkeeler.com/2009/05/php-security-sql-injection-in-order-by/]

The problem is esc_sql() doesn't work when the user input isn't going between single-quotes. Like with column names.

It's super-unlikely this code would be exposed in a way that would allow it to be exploited, but it's worth noting, and perhaps adding a whitelist array of accepted values for orderby and order.

I've been playing around with your great tutorial and I ran into the "headers already sent" warning while trying to delete an item. This also happens while using the bulk delete actions.

This is caused by the wp_redirect inside process_bulk_action.

May I ask you what were you trying to acomplish with wp_redirect(esc_url(add_query_arg())); exit;?
Without these lines of code the delete operations work just fine.