diff --git a/adm/shop_admin/couponlist.php b/adm/shop_admin/couponlist.php
index 71d230bbf..dcc39f021 100644
--- a/adm/shop_admin/couponlist.php
+++ b/adm/shop_admin/couponlist.php
@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "r");
 
 $sql_common = " from {$g5['g5_shop_coupon_table']} ";
 
+if ($sfl && !in_array($sfl, array('mb_id', 'cp_subject', 'cp_id'))) $sfl = '';
+
 $sql_search = " where (1) ";
 if ($stx) {
     $sql_search .= " and ( ";
diff --git a/adm/shop_admin/itemqalist.php b/adm/shop_admin/itemqalist.php
index 2230bf5c3..c9cade868 100644
--- a/adm/shop_admin/itemqalist.php
+++ b/adm/shop_admin/itemqalist.php
@@ -31,6 +31,9 @@ if (!$sst) {
     $sst = "iq_id";
     $sod = "desc";
 }
+$allowed_sst = array('iq_id', 'a.it_id', 'it_name', 'iq_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'iq_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 
 $sql_common = "  from {$g5['g5_shop_item_qa_table']} a
                  left join {$g5['g5_shop_item_table']} b on (a.it_id = b.it_id)
diff --git a/adm/shop_admin/itemuselist.php b/adm/shop_admin/itemuselist.php
index aa4ffadf9..9423e5938 100644
--- a/adm/shop_admin/itemuselist.php
+++ b/adm/shop_admin/itemuselist.php
@@ -33,6 +33,9 @@ if (!$sst) {
     $sst = "is_id";
     $sod = "desc";
 }
+$allowed_sst = array('is_id', 'a.it_id', 'it_name', 'is_name', 'is_score', 'is_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'is_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 
 $sql_common = "  from {$g5['g5_shop_item_use_table']} a
                  left join {$g5['g5_shop_item_table']} b on (a.it_id = b.it_id)
diff --git a/shop/list.php b/shop/list.php
index 5a5da824c..889d422c0 100644
--- a/shop/list.php
+++ b/shop/list.php
@@ -8,6 +8,9 @@ $skin = isset($_REQUEST['skin']) ? safe_replace_regex($_REQUEST['skin'], 'skin')
 if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
     $sort='';
 }
+if( !isset($sortodr) || !in_array(strtolower($sortodr), array('asc', 'desc')) ){
+    $sortodr='';
+}
 
 if (G5_IS_MOBILE) {
     include_once(G5_MSHOP_PATH.'/list.php');