Double quote the column name "order".

Of course this causes the SQL to fail, using a keyword for a column
name.
Removed quotes around the "0" because it is an integer not a string.
Wrapped the entrie SQL statements in insgle quotes. No ned for PHP to
parse the string for vars.