ORDER BY clause is not working properly

用户可以自己在前端选择字段，动态排序。用MyBatis，SQL如下。发现ORDER BY没有起作用。

<select id="selectBudgetCategoryList" resultMap="BaseResultMap" parameterType="com.xxx.ConfigSearchParam">

<include refid="pageHeader"/>

select

<include refid="Base_Column_List" />

from EMR_BUDGET_CATEGORY

where 1=1

<if test="id != null and id != 0" >

and BUDGET_CATEGORY_REF_ID = #{id,jdbcType=DECIMAL}

</if>

<if test="name != null" >

and UPPER(BUDGET_CATEGORY) LIKE '%'||UPPER(#{name,jdbcType=VARCHAR})||'%'

</if>

<if test="deleteFlag != null" >

and DELETE_FLAG = #{deleteFlag,jdbcType=CHAR}

</if>

<if test="sortOrder != null and sortOrder != ''" >

order by #{sortOrder,jdbcType=VARCHAR}

</if>

<include refid="pageFoot"/>

</select>

调查结果如下：

#{} is used to put a parameter. This is the same as using ? in a PreparedStatement.

${} is string substitution. It doesn't use any parameter. This is the one that opens you to SQL injection.

To prevent SQL injection, the best thing to do is always use #{} when possible.

When you need to use ${}, make sure that the value is given by your code (usually a constant) and not by a user.