$allowedList = array ('fulln', 'teamname', 'position'); # Basically the ordering that you want to allow
if (isset ($_GET['orderBy']))
{
...$orderBy = $_GET['orderBy'];
...if (! in_array ($orderBy, $allowedList))
...{
......die ('Bad request - or put something more fancy here');
...}
}
# connect to your database here and do the rest of stuffs as above