diff --git a/endpoint/endpoint.go b/endpoint/endpoint.go
index 7a50597..a8cf18f 100644
--- a/endpoint/endpoint.go
+++ b/endpoint/endpoint.go
@@ -3,6 +3,9 @@ package endpoint
 import (
 	"context"
 	"encoding/json"
+	"strings"
+
+	"errors"
 
 	"github.com/go-kit/kit/endpoint"
 	"github.com/sapawarga/userpost-service/helper"
@@ -13,6 +16,11 @@ import (
 func MakeGetListUserPost(ctx context.Context, usecase usecase.UsecaseI) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (response interface{}, err error) {
 		req := request.(*GetListUserPostRequest)
+		cASC := strings.Compare(helper.GetStringFromPointer(req.SortBy), "ASC")
+		cDESC := strings.Compare(helper.GetStringFromPointer(req.SortBy), "DESC")
+		if req.SortBy != nil && (cASC*cDESC == 1) {
+			return nil, errors.New("must_between_ASC_DESC")
+		}
 		// TODO: for get metadata from headers grpc needs to update when using authorization
 		resp, err := usecase.GetListPost(ctx, &model.GetListRequest{
 			ActivityName: req.ActivityName,
diff --git a/repository/mysql/userpost.go b/repository/mysql/userpost.go
index 2a40659..7134005 100644
--- a/repository/mysql/userpost.go
+++ b/repository/mysql/userpost.go
@@ -33,8 +33,7 @@ func (r *UserPost) GetListPost(ctx context.Context, request *model.UserPostReque
 		params = append(params, request.Offset, request.Limit)
 	}
 	if request.OrderBy != nil && request.SortBy != nil {
-		query.WriteString(" ORDER BY ? ?")
-		params = append(params, request.OrderBy, request.SortBy)
+		query.WriteString(fmt.Sprintf(" ORDER BY %s %s", *request.OrderBy, *request.SortBy))
 	}
 	if ctx != nil {
 		err = r.conn.SelectContext(ctx, &result, query.String(), params...)
diff --git a/usecase/usecase.go b/usecase/usecase.go
index a9c6c00..68b32b6 100644
--- a/usecase/usecase.go
+++ b/usecase/usecase.go
@@ -41,7 +41,7 @@ func (p *Post) GetListPost(ctx context.Context, params *model.GetListRequest) (*
 		Offset:       helper.SetPointerInt64(offset),
 		Limit:        helper.SetPointerInt64(limit),
 		SortBy:       params.SortBy,
-		OrderBy:      params.ActivityName,
+		OrderBy:      params.OrderBy,
 	}
 
 	listData, err := p.repoPost.GetListPost(ctx, req)