may as well escape $order as well, and remove debug file_put_contents