sanitize_sql_orderby( string $orderby )

Ensures a string is a valid SQL ‘order by’ clause.

Description Description

Accepts one or more columns, with or without a sort order (ASC / DESC). e.g. ‘column_1’, ‘column_1, column_2’, ‘column_1 ASC, column_2 DESC’ etc.

Also accepts ‘RAND()’.

Parameters Parameters


(string) (Required) Order by clause to be validated.

Top ↑

Return Return

(string|false) Returns $orderby if valid, false otherwise.

Top ↑

Source Source

File: wp-includes/formatting.php

function sanitize_sql_orderby( $orderby ) {
	if ( preg_match( '/^\s*(([a-z0-9_]+|`[a-z0-9_]+`)(\s+(ASC|DESC))?\s*(,\s*(?=[a-z0-9_`])|$))+$/i', $orderby ) || preg_match( '/^\s*RAND\(\s*\)\s*$/i', $orderby ) ) {
		return $orderby;
	return false;

Top ↑

Changelog Changelog

Version Description
2.5.1 Introduced.

Top ↑

User Contributed Notes User Contributed Notes

You must log in before being able to contribute a note or feedback.