diff --git a/app/common/dao/base.go b/app/common/dao/base.go
index e8f92da..ab5c989 100644
--- a/app/common/dao/base.go
+++ b/app/common/dao/base.go
@@ -1,6 +1,8 @@
 package dao
 
 import (
+	"regexp"
+	"strings"
 	"yintai-api/base/global"
 
 	"gorm.io/gorm"
@@ -13,3 +15,16 @@ func getDB(db ...*gorm.DB) *gorm.DB {
 
 	return global.GetDB()
 }
+
+func ezSort(a string) string {
+	var sortCol = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+	s := strings.Fields(a)
+	if len(s) != 2 || !sortCol.MatchString(s[0]) {
+		return ""
+	}
+	dir := strings.ToUpper(s[1])
+	if dir != "ASC" && dir != "DESC" {
+		return ""
+	}
+	return "`" + s[0] + "` " + dir
+}
diff --git a/app/common/dao/category.go b/app/common/dao/category.go
index 5f2248a..649d85a 100644
--- a/app/common/dao/category.go
+++ b/app/common/dao/category.go
@@ -91,7 +91,7 @@ func (r *Category) List(pid int64, name, nameEn, types string, page, size int, s
 		tx = tx.Where("name_en LIKE ?", fmt.Sprintf("%%%s%%", nameEn))
 	}
 
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	} else {
 		tx = tx.Order("create_time desc")
diff --git a/app/common/dao/document.go b/app/common/dao/document.go
index 4571adf..921c85b 100644
--- a/app/common/dao/document.go
+++ b/app/common/dao/document.go
@@ -87,10 +87,10 @@ func (r *Document) List(lang string, categoryID int64, fileName, title, subTitle
 		return nil, 0, err
 	}
 
-	if sort == "" {
-		tx = tx.Order("p.weight DESC")
-	} else {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
+	} else {
+		tx = tx.Order("p.weight DESC")
 	}
 
 	if err := tx.Offset((page - 1) * size).Limit(size).Select("p.*,t.*,c.name as category_name,c.name_en as category_en,c.id as category_id").Find(&list).Error; err != nil {
diff --git a/app/common/dao/job.go b/app/common/dao/job.go
index 488f0e4..1d96010 100644
--- a/app/common/dao/job.go
+++ b/app/common/dao/job.go
@@ -93,9 +93,7 @@ func (r *Job) List(lang, city, title, desc, reqs, jobType, jobArea, jobUnit stri
 		return nil, 0, err
 	}
 
-	if sort == "" {
-		tx = tx.Order(sort)
-	} else {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	}
 
diff --git a/app/common/dao/news.go b/app/common/dao/news.go
index 732cf24..75d269f 100644
--- a/app/common/dao/news.go
+++ b/app/common/dao/news.go
@@ -87,7 +87,7 @@ func (r *News) List(lang, title, content, publishTime string, categoryID, pinned
 		return nil, 0, err
 	}
 
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	} else {
 		tx = tx.Order("pinned desc,weight desc,create_time desc")
@@ -127,7 +127,7 @@ func (r *News) GetN(categoryID int64, lang string, page, size int, sort string)
 	tx = tx.Joins(fmt.Sprintf(" LEFT JOIN %s c ON c.id = l.category_id", NewCategory().TableName()))
 	tx = tx.Where("c.id = ?", cast.ToInt64(categoryID))
 	tx = tx.Where("t.lang = ?", lang)
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	} else {
 		tx = tx.Order("pinned desc,weight desc,create_time desc")
diff --git a/app/common/dao/page.go b/app/common/dao/page.go
index 4719818..fddd892 100644
--- a/app/common/dao/page.go
+++ b/app/common/dao/page.go
@@ -59,7 +59,7 @@ func (r *Page) List(name string, page, size int, sort string) ([]*model.Page, in
 		return nil, 0, err
 	}
 
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	} else {
 		tx = tx.Order("id,pid,weight desc")
diff --git a/app/common/dao/process.go b/app/common/dao/process.go
index a59c672..c4cf615 100644
--- a/app/common/dao/process.go
+++ b/app/common/dao/process.go
@@ -82,9 +82,7 @@ func (r *Process) List(lang, title, content, processTime string, categoryID int6
 		return nil, 0, err
 	}
 
-	if sort == "" {
-		tx = tx.Order(sort)
-	} else {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	}
 
diff --git a/app/common/dao/resource.go b/app/common/dao/resource.go
index e69cef9..b1936d7 100644
--- a/app/common/dao/resource.go
+++ b/app/common/dao/resource.go
@@ -75,7 +75,7 @@ func (r *Resource) List(name, types, code, method, path string, page, size int,
 		return nil, 0, err
 	}
 
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	} else {
 		tx = tx.Order("id desc")
diff --git a/app/common/dao/role.go b/app/common/dao/role.go
index 29a87ee..1ce5843 100644
--- a/app/common/dao/role.go
+++ b/app/common/dao/role.go
@@ -67,7 +67,7 @@ func (r *Role) List(name, desc string, page, size int, sort string) ([]*model.Ro
 		return nil, 0, err
 	}
 
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	} else {
 		tx = tx.Order("id desc")
diff --git a/app/common/dao/user.go b/app/common/dao/user.go
index c8b033c..e25aa26 100644
--- a/app/common/dao/user.go
+++ b/app/common/dao/user.go
@@ -128,7 +128,7 @@ func (r *User) List(username, account string, role int64, page, size int, sort s
 	}
 
 	tx = tx.Order("id DESC")
-	if sort != "" {
+	if sort = ezSort(sort); sort != "" {
 		tx = tx.Order(sort)
 	}