mysql - PHP | MySQLi prepared statements - Handling order by and order type parameters -

in order avoid sql injection made researched , based on this answer started use mysqli prepared statemets. went fine until got order by , order type parameters sent frontend based on user clicks. more specific have tables headers , user can arrange data considering name, price, date, etc , can choose between asc or desc. store input type hidden guess might able change using firebug. because of need sure can't inject database.

$stmt = $dbconnection->prepare('select * mytable 1 order ? ?'); $stmt->bind_param('ss', $_get['order_by'], $_get['order_type']); 

it seems error. did researches , said there no solution this, person said solution hardcoded , person said have quit using prepared statements , try mysql_real_escape_string in answer linked say:

if you're using recent version of php, mysql_real_escape_string option outlined below no longer available

so gueess not way also. question remains, should next? there solution issue?

you can't use parameters column names, values. check column names valid.

$allowed_order_by = array('col1', 'col2', 'col3', ...); $allowed_order_type = array('asc', 'desc', ''); if (in_array(strtolower($_get['order_by']), $allowed_order_by) &&     in_array(strtolower($_get['order_type'], $allowed_order_type)) {     $stmt = $dbconnection->prepare("         select * mytable          order {$_get['order_by']} {$_get['order_type']}");     $stmt->execute(); }