title: ebean query with setParameter
body: <p>I have a query using a Ebean Finder object. this is a working version:</p>
  
  <pre><code>public static Finder&lt;Long, Device&gt; find = new Finder&lt;&gt;(Long.class, Device.class);
  </code></pre>
  
  <p>.</p>
  
  <pre><code>public static Page&lt;Device&gt; find(int page, String sorting, String order) {
  
      return
              find.where()
                      .orderBy(sorting + " " + order)
                      .findPagingList(10)
                      .setFetchAhead(false)
                      .getPage(page);
  }
  </code></pre>
  
  <p>but now I want to make it SQLInjection-safe by using setParameter function, I tried this, but didn't work. would be great to know what I have wrong.</p>
  
  <pre><code>public static Page&lt;Device&gt; find(int page, String sorting, String order) {
  
      return
              find.where()
                      .orderBy(":sorting :order")
                      .setParameter("sorting", sorting)
                      .setParameter("order", order)
                      .findPagingList(10)
                      .setFetchAhead(false)
                      .getPage(page);
  
  }
  </code></pre>
  
  <p><strong>UPDATE:</strong> </p>
  
  <p>as mentioned <a href="https://stackoverflow.com/a/18898387/3716114">here</a> , </p>
  
  <blockquote>
    <p>"The problem is you can't use named parameters to set the ORDER in an HQL (or SQL) query." </p>
  </blockquote>
  
  <p>If true, this keeps my code vulnerable to SQL injection! so what is your suggestion?</p>