{"record":{"id":"9e11c88b7c628a89","repo":"pagehelper-org/Mybatis-PageHelper","slug":"the-order-by-in-the-original-sql-sql-contains","errorCode":null,"errorMessage":"The order by in the original SQL[${sql}] contains parameters, so it cannot be modified using the OrderBy plugin!","messagePattern":"The order by in the original SQL\\[(.+?)\\] contains parameters, so it cannot be modified using the OrderBy plugin!","errorType":"exception","errorClass":"PageException","httpStatus":null,"severity":"error","filePath":"src/main/java/com/github/pagehelper/parser/defaults/DefaultOrderBySqlParser.java","lineNumber":64,"sourceCode":"    /**\n     * convert to order by sql\n     *\n     * @param sql\n     * @param orderBy\n     * @return\n     */\n    @Override\n    public String converToOrderBySql(String sql, String orderBy) {\n        //解析SQL\n        Statement stmt = null;\n        try {\n            stmt = SqlParserUtil.parse(sql);\n            Select select = (Select) stmt;\n            //处理body-去最外层order by\n            List<OrderByElement> orderByElements = extraOrderBy(select);\n            String defaultOrderBy = PlainSelect.orderByToString(orderByElements);\n            if (defaultOrderBy.indexOf('?') != -1) {\n                throw new PageException(\"The order by in the original SQL[\" + sql + \"] contains parameters, so it cannot be modified using the OrderBy plugin!\");\n            }\n            //新的sql\n            sql = select.toString();\n        } catch (Throwable e) {\n            log.warn(\"Failed to handle sorting: \" + e + \", downgraded to a direct splice of the order by parameter\");\n        }\n        return sql + \" order by \" + orderBy;\n    }\n\n    /**\n     * extra order by and set default orderby to null\n     *\n     * @param select\n     */\n    public static List<OrderByElement> extraOrderBy(Select select) {\n        if (select != null) {\n            if (select instanceof PlainSelect || select instanceof SetOperationList) {\n                List<OrderByElement> orderByElements = select.getOrderByElements();","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/pagehelper-org/Mybatis-PageHelper/blob/c692616c5bc95b41aa779b502f991825c8e5acbc/src/main/java/com/github/pagehelper/parser/defaults/DefaultOrderBySqlParser.java#L46-L82","documentation":"Thrown when PageHelper's OrderBy plugin rewrites the outer ORDER BY of the SQL and finds a '?' placeholder in the parsed order-by clause. Since the plugin rebuilds the SQL string without binding the original order-by parameters, it refuses to modify such SQL.","triggerScenarios":"Calling PageHelper.orderBy/startPage with orderBy on SQL whose ORDER BY clause already contains JDBC parameter placeholders, e.g. 'SELECT * FROM t ORDER BY ?' or parameters inside expressions in the order-by.","commonSituations":"Dynamically generated SQL with parameterized sort expressions; user code passing SQL with order-by placeholders through the OrderBy plugin; stored SQL fragments using ? in ORDER BY for sort direction/columns.","solutions":["Remove parameters from the ORDER BY clause of the base SQL and supply sort columns via PageHelper.orderBy instead","Use ${} substitution for trusted sort columns instead of ? in the ORDER BY clause","Keep orderBy parameters out of the outer-most SELECT; move sorting into the caller-supplied orderBy string"],"exampleFix":"// before\nString sql = \"SELECT * FROM user ORDER BY ?\";\n// after\nString sql = \"SELECT * FROM user\";\nPageHelper.orderBy(\"create_time desc\");","handlingStrategy":"validation","validationCode":"String upper = sql.toUpperCase();\nint ob = upper.lastIndexOf(\" ORDER BY \");\nif (ob != -1 && sql.substring(ob).contains(\"?\")) {\n    throw new IllegalArgumentException(\"ORDER BY contains ?; move sorting to PageHelper.orderBy\");\n}","typeGuard":null,"tryCatchPattern":"try { PageHelper.orderBy(\"col desc\"); } catch (PageException e) {\n    log.warn(\"order-by rewrite failed, falling back to raw sql\", e);\n}","preventionTips":["Never parameterize the ORDER BY clause with ? in SQL handed to the OrderBy plugin","Pass sort criteria via PageHelper.orderBy rather than embedding in SQL","Sanitize/whitelist sort column names instead of using bind parameters","Watch the plugin's 'Failed to handle sorting' warnings in logs"],"tags":["java","pagehelper","sql-parsing","order-by"],"backgroundTag":"unsupported-operation","analyzedSha":"c692616c5bc95b41aa779b502f991825c8e5acbc","analyzedAt":"2026-09-08T03:50:49.192Z","contentChangedAt":"2026-09-08T03:50:49.192Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}