make sortorder be asc or desc, not something arbitrary which needs to be escaped
other fixes to use parameter passing to PDO instead of escaping them ourselves