One VERY MINOR point is that with the placeholder version, your database sees both sort-column statements as being the same statement (ending in ORDER by ?) as opposed to two statements with differing ORDER clauses. One single statement means one single prepare / execution plan, and thus saves time.
I must confess, I use BOTH techniques as I see convenient.
{}think; #Think outside of the brackets
Comment on Re: Safety of concatenating query string
I wonder what database would allow "... ORDER BY ?", especially since different values for the order by clause would lead to (quite likely wildly) different execution plans.
Jenda Enoch was right!
Enjoy the last years of Rome.