Dynamic Queries with JSP

Question

I am developing a search page which should first bring the results sorted by some particular field & then the user should have the option of sorting the results by other field names which are provided in a form list.
For generating dynamic requests, ? is used in place of parameter. But for some reason it is not working with Order by. Other dynamic queries are working fine. Please let me know the right way to handle it.
And also if someone can advise a good reference book for dynamic SQL statements in accordance with JSP.
Thanks for your time.

Answer 1

Never mind my previous solution. Some success was not perfect, therefore not acceptable. I used a scriplet and the problem is solved!
  <!-- Dynamically build the query -->
    <%
      String sql = "select * from issue_list_view";
      String where = null;
      String param = null;
      // Status
      param = (String)pageContext.getAttribute("status");
      if(param != null && param.compareTo("")!=0)
        where = "status='"+param+"'";
      else
        where = "status not in ('Closed','Duplicate')";
      // Assigned To
      param = (String)pageContext.getAttribute("assign");
      if(param != null && param.compareTo("")!=0)
        if(where.length()>0) {where += " and ";}
        where = "category='"+param+"'";
      // Category
      param = (String)pageContext.getAttribute("category");
      if(param != null && param.compareTo("")!=0)
        if(where.length()>0) {where += " and ";}
        where = "category='"+param+"'";
      // Type
      param = (String)pageContext.getAttribute("type");
      if(param != null && param.compareTo("")!=0)
        if(where.length()>0) {where += " and ";}
        where += "issue_type='"+param+"'";
      // Id
      param = (String)pageContext.getAttribute("id");
      if(param != null && param.compareTo("")!=0)
        if(where.length()>0) {where += " and ";}
        where += "issue_id="+param;
      // Add where clause if needed
      if(where != null) { sql += " where " + where; }
    %>
    <!-- Do the query -->
    <sql:query var="issues" sql="<%=sql%>"/>