diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py
index d264d69957..afeefadbab 100644
--- a/frappe/model/db_query.py
+++ b/frappe/model/db_query.py
@@ -1129,8 +1129,9 @@ from {tables}
 			frappe.throw(_("Illegal SQL Query"))
 
 		for field in parameters.split(","):
+			if field.count('"') % 2 or field.count("'") % 2 or field.count("`") % 2:
+				frappe.throw(_("Invalid field name: {0}").format(field))
 			field = field.strip()
-			function = field.split("(", 1)[0].rstrip().lower()
 			full_field_name = "." in field and field.startswith("`tab")
 
 			if full_field_name:
@@ -1140,9 +1141,10 @@ from {tables}
 						tbl = tbl[4:-1]
 					frappe.throw(_("Please select atleast 1 column from {0} to sort/group").format(tbl))
 
-			# Check if the function is used anywhere in the field
-			if any(func in function for func in blacklisted_sql_functions):
-				frappe.throw(_("Cannot use {0} in order/group by").format(function))
+			# Check for SQL function using regex with word boundaries and optional whitespace before parenthesis
+			for func in blacklisted_sql_functions:
+				if re.search(r"\b" + re.escape(func) + r"\s*\(", field.lower()):
+					frappe.throw(_("Cannot use {0} in order/group by").format(field))
 
 	def add_limit(self):
 		if self.limit_page_length: