title: Using prepared statement for Order by to prevent SQL injection java
body: <p>I have a query with where conditions , order by and limit. I am using prepared statements to set the where conditions and limit. Currently i am using string append for order by which causing SQL injection vulnerability.</p>
  
  <p>I cannot use set string to order by like this <code>order by ? ?</code> SQL Order functionality not working if i do like this.</p>
  
  <p><strong>Example query:</strong></p>
  
  <pre><code>SELECT siteid, technology, address, state, status FROM archive  LEFT OUTER 
  JOIN mappings ON siteid = child_site_id order by siteid asc limit ? offset ?
  
  
  SELECT siteid, technology, address, state, status FROM archive  LEFT OUTER 
  JOIN mappings ON siteid = child_site_id order by siteid asc limit 10 offset 0
  </code></pre>
  
  <p>Any other way i can do this to avoid SQL injection.</p>