ORDER BY clause is not working properly

用户可以自己在前端选择字段，动态排序。用MyBatis，SQL如下。发现ORDER BY没有起作用。

 <select id="selectBudgetCategoryList" resultMap="BaseResultMap" parameterType="com.xxx.ConfigSearchParam">

  <include refid="pageHeader"/>
    select
    <include refid="Base_Column_List" />
    from EMR_BUDGET_CATEGORY
    where 1=1
    <if test="id != null and id != 0" >
      and BUDGET_CATEGORY_REF_ID = #{id,jdbcType=DECIMAL}
    </if>
    <if test="name != null" >
      and UPPER(BUDGET_CATEGORY) LIKE '%'||UPPER(#{name,jdbcType=VARCHAR})||'%'
    </if>
    <if test="deleteFlag != null" >
      and DELETE_FLAG = #{deleteFlag,jdbcType=CHAR}
    </if>
    <if test="sortOrder != null and sortOrder != ''" >
      order by #{sortOrder,jdbcType=VARCHAR}
    </if>
    <include refid="pageFoot"/>

  </select>

调查结果如下：

#{} is used to put a parameter. This is the same as using ? in a PreparedStatement. 
${} is string substitution. It doesn't use any parameter. This is the one that opens you to SQL injection. 
To prevent SQL injection, the best thing to do is always use #{} when possible. 
When you need to use ${}, make sure that the value is given by your code (usually a constant) and not by a user.