title: ORDER BY Variable issues
body: <p>I'm having issues passing a variable to ORDER BY in an MSSQL query (through PHP), here the code:</p>
  
  <pre><code>    &lt;?php
  include "connection.php";
  $type = $_POST['type'];
  $order = $_POST['order'];
  $data = $_POST['data'];
  
  $params="@order varchar(10)";
  $paramslist="@order=$order";
  
  $sql = "SELECT * FROM Customer ORDER BY "+@order;
  $dbsql = "EXEC sp_executesql
  N'$sql',
  N'$params',
  $paramslist";
  $result = sqlsrv_query($link, $dbsql);
  if ($result) {
  echo "OK";
  } else {
  echo "FAIL - " . $order . " -- ";
  die(print_r(sqlsrv_errors(), true));
  }
  ?&gt;
  </code></pre>
  
  <p>I get the following error echoed to the browser:</p>
  
  <blockquote>
    <p>FAIL - CompanyName -- Array
    (
        [0] => Array
            (
                [0] => 42000
                [SQLSTATE] => 42000
                [1] => 102
                [code] => 102
                [2] => [Microsoft][SQL Server Native Client 10.0][SQL Server]Incorrect syntax near '0'.
                [message] => [Microsoft][SQL Server Native Client 10.0][SQL Server]Incorrect syntax near '0'.
            )
    )</p>
  </blockquote>
  
  <p>Checks so far:</p>
  
  <ul>
  <li>All POST variables have the required data</li>
  <li>SQL table name correct and data in $order equals the correct column name</li>
  </ul>
  
  <p>I've searched around but can't find anything too helpful, can anyone help?</p>
  
  <p>Thank You.</p>
  
  <p>EDIT:</p>
  
  <p>Ok so code is now:</p>
  
  <pre><code>$params="@order varchar(10)";
  $paramslist="@order=$order";
  $sql = "SELECT * FROM Customer ORDER BY ".$order;
  $dbsql = "EXEC sp_executesql
  N'$sql',
  N'$params',
  $paramslist";
  $result = sqlsrv_query($link, $dbsql);
  </code></pre>
  
  <p>And it works fine, but does this leave it open to SQL injection attacks? Is there any better way of performing this query?</p>
  
  <p>Any help appreciated.</p>