title: PDO Parameter Binding Not Working on Order By
body: <p>Just getting started with parameter binding and I've read all through the docs and quite a few questions/answers here, but I can't seem to get this to work.</p>
  
  <p>Simply sorting via get request.</p>
  
  <pre><code>public function getAttributeGroups($data = array()) {
      $params = array();
      $sql = "
          SELECT * 
          FROM {$this-&gt;db-&gt;prefix}attribute_group ag 
          LEFT JOIN {$this-&gt;db-&gt;prefix}attribute_group_description agd 
          ON (ag.attribute_group_id = agd.attribute_group_id) 
          WHERE agd.language_id = '" . (int)$this-&gt;config-&gt;get('config_language_id') . "'";
  
      $sort_data = array(
          'agd.name',
          'ag.sort_order'
      );  
  
      if (isset($data['sort']) &amp;&amp; in_array($data['sort'], $sort_data)) {
          //$sql .= " ORDER BY " . $data['sort'];
          $sql .= " ORDER BY :sort";
          $params[':sort'] = $data['sort'];
      } else {
          $sql .= " ORDER BY agd.name";   
      }   
  
      if (isset($data['order']) &amp;&amp; ($data['order'] == 'DESC')) {
          $sql .= " DESC";
      } else {
          $sql .= " ASC";
      }
  
      if (isset($data['start']) || isset($data['limit'])) {
          if ($data['start'] &lt; 0) {
              $data['start'] = 0;
          }               
  
          if ($data['limit'] &lt; 1) {
              $data['limit'] = 20;
          }   
  
          $sql .= " LIMIT " . (int)$data['start'] . "," . (int)$data['limit'];
      }
  
      $query = $this-&gt;db-&gt;query($sql, $params);
  
      return $query-&gt;rows;
  }
  </code></pre>
  
  <p>The quoted line is the original that sorts just fine, but in analyzing the code is open to injections.</p>
  
  <p>The above does execute a query and returns data, but it doesn't sort by the passed in binding.</p>
  
  <p>What am I missing?</p>