Parameters in QueryBuilder (Doctrine/Symfony) - symfony

Question

I have this code:
$sort = (is_null($sort)) ? 'i.name' : $sort;
$order = (!is_null($order) && $order == 'ASC') ? 'ASC' : 'DESC';
$queryBuilder
->select('s')
->from('Model:Item', 'i')
->where('i.isRemoved = false')
->orderBy(':sort', $order)
->setParameter('sort', $sort);
But I get this error:
[1/2] QueryException: SELECT i FROM Model:Item i WHERE i.isRemoved = false ORDER BY :sort DESC
I must be doing something wrong with the setParameter() call, but I can't figure out what?
Any ideas? Thanks

Answer 1

setParameter() is used to prevent SQL injection attacks, since many WHERE clauses rely on user input.
And this might be the cause of the problem here -- I'm not entirely sure that the ORDER BY clause supports parameter replacement. I may be wrong on that, but your error seems to indicate that either (1) it doesn't support it, or (2) you're getting bad input.
Where exactly are you getting your $sort from? If it's coming from some user input, then you might want to perform the sanitization logic here instead, and just set the resolved value in the orderBy() method.
Consider an example where id and name are actual fields. What happens when someone tries to pass in i.description? The entire SQL would fail. But not if you did something like this:
$sort = (in_array($sort, array('i.id', 'i.name')))
? $sort
: 'i.name';
// Now you've effectively sanitized the value
// i.e. It's *always* going to be either 'i.id' or 'i.name'
// So there's no reason to need something like setParameter()
$queryBuilder
->select('s')
->from('Model:Item', 'i')
->where('i.isRemoved = false')
->orderBy($sort);