mybatis查询 字符串key无法被识别为sql关键字问题

查询代码如下

   <!-- 根据params(匹配) searchPram(模糊字段) sortPram(排序) 查询  返回单个数据-->
  <select id="getByParam" resultMap="User" parameterType="java.util.Map" >
    select 
    <include refid="Base_Column_List" />
    from user
        <if test="params!= null" >
            where
                <trim  suffixOverrides=" and " >
                    <foreach collection ="params.keys" item="key" index= "index" separator =" and " >
                        ${key}= #{params[${key}]}
                    </foreach>
                </trim>
        </if>
        <if test="searchParams!=null" >
            <if test="params==null" >
                where
            </if>
            <if test="params!=null" >
                and
            </if>
        </if>
        <if test="searchParams != null" >
            <trim prefix="("  suffix=")" suffixOverrides=" or " >
                    <foreach collection ="searchParams.keys" item="key" index= "index" separator =" or " >
                        ${key} like #{searchParams[${key}]}
                    </foreach>
            </trim>
        </if>   
        <if test="sortParams != null" >
            order by
            <trim suffixOverrides=",">
                <foreach collection ="sortParams.keys" item="key" index= "index"  separator=",">
                    #{sortParams[${key}]}  ${key} 
                </foreach>
            </trim>
        </if>   
    limit 0,1
  </select>

执行结果

 22:05:44.292 [http-bio-80-exec-8] DEBUG com.xjt.dao.UserDao.getByParam - ==>  Preparing: select id, userName, password, age from user where userName= ? order by ? desc limit 0,1 
22:05:44.292 [http-bio-80-exec-8] DEBUG com.xjt.dao.UserDao.getByParam - ==> Parameters: 230(String), id(String)
22:05:44.293 [http-bio-80-exec-8] DEBUG com.xjt.dao.UserDao.getByParam - <==      Total: 1

从结果上看 order by 后的？无法被识别为关键字。求有经验的大神指点！

你如果用#{},那它就会把值转为字符串,而不是关键字,${}是把他转为关键字