> Do I need to duplicate the whole query to another literal just to change the sort field?

Works for me! :3

Now, your standard parameterized query API would presumably accept dynamically constructed strings for input parameters (since it's clear from the API that those should be unconditionally escaped, and it can internally do the right thing (tm)) but not the query.

On the minus side, being a complete SQL scrub, I'm not sure if this works for specifying sort fields dynamically. Although, I'm already imagining a defcon talk on performing timing attacks against a query that sorts a password field... am I paranoid enough yet?