What would be a good check to remove all possibility of SQL-injection on an
ORDER BY col where
col is an unsafe variable?
I'm currently removing
[^A-Za-z0-9_] from the string in php. Is this too paranoid or maybe even not enough?
Just to clarify: I'm looking for a way to remove any SQLi from an
ORDER BY $unsafeVariable - not a general SQLi-prevention solution. I'm already using prepared queries and pdo::quote where needed but since I needed to include an unsafe variable in a
order by statement I thought I'd ask for someone elses opinion.