Escaping ORDER BY clause using mysqli_real_escape_string() function : <p>I am using different values in ORDER BY clause of SQL queries based upon user selection. How do I escape this selected value using mysqli_real_escape_string() function?</p>

<p>For example, the url is as following:</p>

<pre><code>localhost/person/person_listing.php?sort_by=date_of_birth
</code></pre>

<p>Based on this I am using:</p>

<pre><code>if (isset($_GET['sort_by'])) {
    $sort_by = trim($_GET['sort_by']);
    if (!empty($sort_by)) {
        $order_by_sql = " ORDER BY $sort_by";
    }
}
</code></pre>

<p>The question is, what is the best way to escape this type of add-on to SQL? Can the entire ORDER BY clause be escaped at once, or each value has to be escaped individually?</p>
