WooYun.org

public function orderBy($order)
    {
        if($this->inCondition and !$this->conditionIsTrue) return $this;
        $order  = str_replace(array('|', '', '_'), ' ', $order);
        /* Add "`" in order string. */
        /* When order has limit string. */
        $pos    = stripos($order, 'limit');
        $orders = $pos ? substr($order, 0, $pos) : $order;
        $limit  = $pos ? substr($order, $pos) : '';
        $orders = explode(',', $orders);
        foreach($orders as $i => $order)
        {
            $orderParse = explode(' ', trim($order));
            foreach($orderParse as $key => $value)
            {
                $value = trim($value);
                if(empty($value) or strtolower($value) == 'desc' or strtolower($value) == 'asc') continue;
                $field = trim($value, '`');
                /* such as t1.id field. */
                if(strpos($value, '.') !== false) list($table, $field) = explode('.', $field);
                $field = "`$field`";
                $orderParse[$key] = isset($table) ? $table . '.' . $field :  $field;
                unset($table);
            }
            $orders[$i] = join(' ', $orderParse);
        }
        $order = join(',', $orders) . ' ' . $limit;
        $this->sql .= ' ' . DAO::ORDERBY . " $order";
        return $this;
    }