Steps to reproduce the issue

This has been tested using both Sorcerer and DirectPHP to embed php (and thus SQL) code in the body of an article. Same effect with either plug-in.

1) Place SQL code (preferably an Insert, but Select works as well) in an Article body, execute the Article and confirm that the SQL works.
2) Place the Article in a Category and place the Category List in a Menu item.
3) Display the menu.

Expected result

Simple listing of the Category items.

Actual result

Simple listing of the Category items AND
All of the SQL statements that are embedded in the Articles that are included in the Category list will be EXECUTED when the Category List is displayed!!!

System information (as much as possible)

Joomla 3.43
Sourcerer 5.0.0
PHP 5.4.42
MySQL 5.5.42

Additional comments

SQL Statement in 1st Article Body (Test Select)(encapsulated in Sourcerer tags)

{source}<?php
//$db = JFactory::getDbo(); / JFactory is not necessary with Sourcerer - it automatically creates the $db object
$query = $db->getQuery(true);

$query->select($db->quoteName(id));
$query->from($db->quoteName('test'));
$query->order('id DESC');
$query->setLimit('1');

$db->setQuery($query);
$results = $db->loadResult();

var_dump($results);
echo "<br>ID is: " . $results;
echo "<br>New ID is: " . $results += 1;
?>{/source}

Alternatively, you can do a file include with the same effect.

SQL Statement in 2nd Article Body (Test Insert)

{source}<?php

// Test - insert a record into test table (id date_time text) not part of Fabrik universe

$date = JFactory::getDate();

// Get a db connection.
$db= JFactory::getDbo();

// Create a new query object.
$query = $db->getQuery(true);

// Determine the value for the next record

$columns = array('date_time', 'element');

$values = array($db->quote($date), $db->quote("sample text"));


// Build the query

$query

     ->insert($db->quoteName('test'))

     ->columns($db->quoteName($columns))

     ->values(implode(',', $values));



// Execute the query

$db->setQuery($query);

$db->execute();

echo '<h3><p style="text-align:center">Your submission to the TEST table  has been received. <br>Thank you for helping out!</p></h3>';

?>{/source}

Display the Category List (in Debug Mode)

**Title**       **Author**      **Hits**    
Test Insert     **Written by Super User**   **Hits: 9**
Test Select     **Written by Super User**   **Hits: 38**

Selected SQL statements from display of Category List

**Query Time: 0.41 ms** **After last query: 14.63 ms**

INSERT INTO `test`
(`date_time`,`element`) 
  VALUES 
('2015-08-04 01:14:39','sample text')

**Explain**
**EXPLAIN not possible on query: INSERT INTO `test` (`date_time`,`element`) VALUES ('2015-08-04 01:14:39','sample text')**
**Profile**
**No SHOW PROFILE (maybe because there are more than 100 queries)**
**Call Stack**
JROOT/plugins/content/DirectPHP/DirectPHP.php(58) : eval()'d code:51
JROOT/plugins/content/DirectPHP/DirectPHP.php:58
JROOT/libraries/joomla/event/event.php:69
JROOT/libraries/joomla/event/dispatcher.php:160
JROOT/components/com_content/views/category/view.html.php:106
JROOT/libraries/legacy/controller/legacy.php:690
JROOT/components/com_content/controller.php:104
JROOT/libraries/legacy/controller/legacy.php:728
JROOT/components/com_content/content.php:16
JROOT/libraries/cms/component/helper.php:392
JROOT/libraries/cms/component/helper.php:372
JROOT/libraries/cms/application/site.php:191
JROOT/libraries/cms/application/site.php:230
JROOT/libraries/cms/application/cms.php:252
JROOT/index.php:45
[**Add xdebug.file_link_format directive to your php.ini file to have links for files.**]
**Query Time: 0.20 ms** **After last query: 1.95 ms**

SELECT `id`

  FROM `test`

  ORDER BY id DESC 
  LIMIT 0, 1

**Explain**
id  select_type table   type    possible_keys   key key_len ref rows    Extra
1   SIMPLE  test    index   NULL    PRIMARY 4   NULL    1   Using index
**Profile**
**No SHOW PROFILE (maybe because there are more than 100 queries)**
**Call Stack**
JROOT/includes/test_select.php:15
JROOT/plugins/content/DirectPHP/DirectPHP.php(58) : eval()'d code:1
JROOT/plugins/content/DirectPHP/DirectPHP.php:58
JROOT/libraries/joomla/event/event.php:69
JROOT/libraries/joomla/event/dispatcher.php:160
JROOT/components/com_content/views/category/view.html.php:106
JROOT/libraries/legacy/controller/legacy.php:690
JROOT/components/com_content/controller.php:104
JROOT/libraries/legacy/controller/legacy.php:728
JROOT/components/com_content/content.php:16
JROOT/libraries/cms/component/helper.php:392
JROOT/libraries/cms/component/helper.php:372
JROOT/libraries/cms/application/site.php:191
JROOT/libraries/cms/application/site.php:230
JROOT/libraries/cms/application/cms.php:252
JROOT/index.php:45

Note: there is a workaround for the end user until this gets fixed. Have an Article listed in the Category (NSN) with a call to the Article containing the SQL statements. Place the Articles containing the SQL code in a different Category (nsn-code) which (hopefully) never gets listed.

<?php
// Calling Article in NSN Category

echo "
      window.open( 'http://localhost:8888/joomla_test/index.php/nsn-code/72-test-insert', '_self');
   </script>
";

?>