Question

I’m trying to pass two variables into ORDER BY $variable1 $variable2 inside MySQL statement. The variables are gotten from a dropdown Menu form.

PHP

if(isset($_POST['order'])){
         $sort1 = mysql_real_escape_string($_POST['sort']);
         $sort2 = mysql_real_escape_string($_POST['order']);
        }
        if(!@$_POST['order']){
            $sort1 = 'ID';
            $sort2 = 'DESC';
        }
        $topics = mysql_query(" SELECT topic_id AS 'ID', topic_head AS 'Title', 
                                       topic_tags AS 'TAGS', topic_owner AS 'CREATED BY', topic_date AS 'CREATED ON'
                                FROM   forum_topics 
                                ORDER BY '{$sort1}' '{$sort2}'  ") or die (mysql_error());
                        ?>

HTML FORM

<ul class="sort">
        <li><form action="topics.php" method="post">
                <label class="label">Sort Table By</label>
                <select name="sort">
                    <option value ="">    </option>
                    <option value ="ID">ID</option>
                    <option value ="Title">Title</option>
                    <option value ="TAGS">TAGS</option>
                    <option value ="VIEWS">VIEWS</option>
                    <option value ="CREATED ON">CREATED ON</option>
                    <option value ="CREATED BY">CREATED BY</option>
                </select>

                <label class="label">Order By</label>

                <select name = "order" class="tap_Select">
                    <option value ="">    </option>
                    <option value ="ASC">Ascending</option>
                    <option value ="DESC">Descending</option>
                </select>

                <input type="submit" name="order" value="SORT" >
           </form>
        </li>
    </ul>

Please help.

UPDATE

When I remove quotes around $sort1 and $sort2

I get this error:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SORT' at line 4

UPDATE 2

When I did the $sql = “…..” , without passing it through mysql_querry()
I got this

SELECT topic_id AS 'ID', topic_head AS 'Title', topic_tags AS 'TAGS', topic_owner AS 'CREATED BY', topic_date AS 'CREATED ON' FROM forum_topics ORDER BY ID SORT

Answer 1

Don’t use quotes, e.g.

ORDER BY 'ID' 'DESC'

is incorrect. It should be

ORDER BY ID DESC

the quotes turn id and desc into plain strings, not keywords/fieldnames.