diff --git a/lib/xapi.js b/lib/xapi.js
index 570f6129c7..aef5cdfbcd 100644
--- a/lib/xapi.js
+++ b/lib/xapi.js
@@ -284,7 +284,7 @@ class Xapi {
     this.mysql.getHavingClause(req.query._having, req.app.locals._tableName, queryParamsObj);
 
     /**************** add order clause ****************/
-    queryParamsObj.query += this.mysql.getOrderByClause(req.query, req.app.locals._tableName);
+    this.mysql.getOrderByClause(req.query, req.app.locals._tableName, queryParamsObj);
 
     /**************** add limit clause ****************/
     queryParamsObj.query += ' limit ?,? '
@@ -497,7 +497,7 @@ class Xapi {
       /**************** where clause ****************/
       this.mysql.getHavingClause(req.query._having, req.app.locals._tableName, queryParamsObj, ' having ');
 
-      queryParamsObj.query = queryParamsObj.query + this.mysql.getOrderByClause(req.query, tableName);
+      this.mysql.getOrderByClause(req.query, tableName, queryParamsObj);
 
       //console.log(queryParamsObj.query, queryParamsObj.params);
       var results = await this.mysql.exec(queryParamsObj.query, queryParamsObj.params);
diff --git a/lib/xsql.js b/lib/xsql.js
index 5037747252..d15e2b6253 100644
--- a/lib/xsql.js
+++ b/lib/xsql.js
@@ -215,30 +215,27 @@ class Xsql {
   }
 
 
-  getOrderByClause(queryparams, tableName) {
-
-    //defaults
-    let orderBy = '';
+  getOrderByClause(queryparams, tableName, queryParamsObj) {
 
     if (queryparams._sort) {
 
-      orderBy += ' ORDER BY '
+      queryParamsObj.query += ' ORDER BY '
 
       let orderByCols = queryparams._sort.split(',')
 
       for (let i = 0; i < orderByCols.length; ++i) {
         if (i) {
-          orderBy = orderBy + ', '
+          queryParamsObj.query += ', '
         }
         if (orderByCols[i][0] === '-') {
           let len = orderByCols[i].length;
-          orderBy = orderBy + orderByCols[i].substring(1, len) + ' DESC'
+          queryParamsObj.query += ' ?? DESC'
+          queryParamsObj.params.push(orderByCols[i].substring(1, len) )
         } else {
-          orderBy = orderBy + orderByCols[i] + ' ASC'
+          queryParamsObj.query += ' ?? ASC'
+          queryParamsObj.params.push(orderByCols[i])
         }
-
       }
-
     }
 
     return orderBy