/* The original query with blanks to be filled in. */
$szSQL = "SELECT * FROM members ORDER by %s %s";

/* Set the defaults if invalid fields are supplied, or none at all. */
$szDefaultField = 'name';
$szDefaultOrder = 'asc';

/* Set the restrictions for both so users can't enter just anything. */
$aAllowedFields = array('name', 'username');
$aAllowedOrders = array('desc', 'asc');

/* Set to the ones specified, but if we have none, set to the defaults. */
$szField = isset($_GET['field']) ? strtolower($_GET['field']) : $szDefaultField;
$szOrderBy = isset($_GET['order']) ? strtolower($_GET['order']) : $szDefaultOrder;

/* Check if we're allowed this particular field in the query. */
if (!in_array($szField, $aAllowedFields))
{
    $szField = $szDefaultField;
}

/* Check if we're allowed this particular ordering in the query. */
if (!in_array($szOrderBy, $aAllowedOrders))
{
    $szOrderBy = $szDefaultOrder;
}

/* Build the new query with the ordering on field and ASC/DESC. */
$szSQL = sprintf($szSQL, $szField, $szOrderBy);

/* Query to execute... */
printf("Executing Query: %s", $szSQL);

<h1>Orders</h1>

<ul>
    <li><a href="?field=name&order=asc">Order by Name Ascending</a></li>
    <li><a href="?field=username&order=asc">Order by Username Ascending</a></li>
    <li><a href="?field=name&order=desc">Order by Name Descending</a></li>
    <li><a href="?field=username&order=desc">Order by Username Descending</a></li>
</ul>