Building a dynamic sql query with ORDER BY + Variables

[fael097]

hi, im building a search engine (ebay like) wich should work like this: you can display a list of products by selecting the category or typing a search keyword (i'll try to make it like you can search your keyword only inside that category later), and when result list is being shown, you can sort it by the field's name (name, brand, category and price) by clicking the fields header, doing so i get a variable with the fields name to put in my sql query on "order by $field" for example. First problem: it says i have an incorrect mysql syntax. Second problem: i need an initial 'order by' value, wich changes when i click a link specifying a name for the order by. If someone can help, i would be really glad.  here's the sql query section.

$string=$_GET['string'];
$cat=$_GET['cat'];
$order=$_GET['order'];
$dir=$_GET['dir'];
$sql="SELECT * FROM `test` WHERE `name` LIKE '$string' OR `brand` LIKE '$string' OR `category` LIKE '$string' ORDER BY $order $dir";

 

the $order variable defines the column name wich the result will be sorted by, and the $dir variable dedfines DESC or ASC only. my syntax error is related to this, because if i change the

$order=$_GET['order'];
$dir=$_GET['dir'];

to

$order=id;
$dir=DESC;

the sql syntax works fine, as you can see in http://fael097.site11.com/test (obviously ordering result by column wont work)

thanks for any kind of help!