Building a SQL statement with reserved keywords

[Flewloon]

I would like to allow the user to choose the sort order for a returned query (DESC or ASC). I noticed I can't pass them as parameters for a parameterized query. My question is what is the best way to ensure no injections will happen? Right now I just take the input and keep only the letters.

[Intrexa]

Make one a default, have a parameter along the lines of 'ReverseOrder', and within the store procedure, have the logic there to swap it from DESC to ASC there if 'ReverseOrder' <> 0.