TYPO3 Core

'where' accpets values by markers. Only 'orderBy' wont accpet marker values.
Its just the example in the doc which wont work as explained.

page.60 = CONTENT
page.60 {
      table = tt_content
      select {
         pidInList = 73
         where = header != ###whatever###
         orderBy = ###sortfield###
         markers {
            whatever.data = GP:first
            sortfield.value = sor
            sortfield.wrap = |ting
         }
      }
}

Throws:
Doctrine\DBAL\Exception\SyntaxErrorException
ORDER BY `'uid` DESC'': You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

This one without markers works:

page.60 = CONTENT
page.60 {
      table = tt_content
      select {
         pidInList = 73
         where = header != ###whatever###
         orderBy = sorting
         markers {
            whatever.data = GP:first
         }
      }
}

So in case an editor should switch the sorting field or sorting order for something, you can't store his selection to a marker and use this in TS select orderBy.
It's not such necessary but i lost some hours in this cause the docs example.

Added issue for docs: https://github.com/TYPO3-Documentation/TYPO3CMS-Reference-Typoscript/issues/352

---

The problem is that the value in the marker is quoted in single quotes which is not correct if a field is to be used in orderBy. (ORDER BY 'sorting').

Quoting in backticks (`sorting`) would be ok.

Connection::quote() is used to quote in single quotes.

Connection::quoteIdentifier() could be used instead.

I don't see an easy way to solve this as the function ContentObjectRenderer::getQueryMarkers() does the quoting in a general way and there is no way to specify how and if the value from the marker should be quoted.

The markers concept was introduced to easily prevent SQL injection with external data in queries. In most cases this data is used as values in expressions and not to create table or column names (or even functions).

As table and column names can be quoted according to documentation, it would be possible to apply quoting with {#...}. Currently this would produce incorrect results because of quotes from markers: `'column_name'`.

This problem could be fixed if \TYPO3\CMS\Core\Database\Query\QueryHelper::quoteDatabaseIdentifiers() would trim any quotes that exist around the matched identifier. I haven't tested this yet.
Yes, the construction would be very ugly, but it's not a very common case: orderBy = {####sortfield###}