diff --git a/novel-admin/src/main/java/com/java2nb/common/annotation/ValidateSortOrder.java b/novel-admin/src/main/java/com/java2nb/common/annotation/ValidateSortOrder.java
new file mode 100644
index 0000000..81b55b3
--- /dev/null
+++ b/novel-admin/src/main/java/com/java2nb/common/annotation/ValidateSortOrder.java
@@ -0,0 +1,13 @@
+package com.java2nb.common.annotation;
+
+import java.lang.annotation.*;
+
+/**
+ * @author xiongxiaoyang
+ * @date 2025/7/17
+ */
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface ValidateSortOrder {
+}
diff --git a/novel-admin/src/main/java/com/java2nb/common/aspect/SortOrderValidationAspect.java b/novel-admin/src/main/java/com/java2nb/common/aspect/SortOrderValidationAspect.java
new file mode 100644
index 0000000..a1e0dae
--- /dev/null
+++ b/novel-admin/src/main/java/com/java2nb/common/aspect/SortOrderValidationAspect.java
@@ -0,0 +1,90 @@
+package com.java2nb.common.aspect;
+
+import com.java2nb.common.annotation.ValidateSortOrder;
+import com.java2nb.common.utils.SortWhitelistUtil;
+import lombok.RequiredArgsConstructor;
+import lombok.SneakyThrows;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.stereotype.Component;
+
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.Map;
+
+/**
+ * @author xiongxiaoyang
+ * @date 2025/7/17
+ */
+@Aspect
+@Component
+@RequiredArgsConstructor
+public class SortOrderValidationAspect {
+
+    /**
+     * 拦截所有的mapper方法
+     */
+    @SneakyThrows
+    @Around("execution(* com.java2nb.*.dao.*Dao.*(..))")
+    public Object validateSortAndOrder(ProceedingJoinPoint joinPoint) {
+        Object[] args = joinPoint.getArgs();
+        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+        Method method = signature.getMethod();
+
+        Annotation[][] parameterAnnotations = method.getParameterAnnotations();
+
+        for (int i = 0; i < parameterAnnotations.length; i++) {
+            boolean hasAnnotation = Arrays.stream(parameterAnnotations[i])
+                .anyMatch(a -> a.annotationType().equals(ValidateSortOrder.class));
+
+            if (hasAnnotation && args[i] != null) {
+                processArgument(args[i]);
+            }
+        }
+
+        return joinPoint.proceed(args);
+    }
+
+    @SneakyThrows
+    private void processArgument(Object obj) {
+        if (obj instanceof Map<?,?> map) {
+            processMap(map);
+        } else {
+            traverseAndSanitize(obj);
+        }
+    }
+
+    @SneakyThrows
+    private void traverseAndSanitize(Object obj) {
+        for (Field field : obj.getClass().getDeclaredFields()) {
+            switch (field.getName()) {
+                case "sort", "order" -> {
+                    field.setAccessible(true);
+                    Object value = field.get(obj);
+                    if (value instanceof String strValue) {
+                        String sanitized = "sort".equals(field.getName())
+                            ? SortWhitelistUtil.sanitizeColumn(strValue)
+                            : SortWhitelistUtil.sanitizeOrder(strValue);
+                        field.set(obj, sanitized);
+                    }
+                }
+                default -> {
+                }
+            }
+        }
+    }
+
+    private void processMap(Map map) {
+        if (map.get("sort") instanceof String sortStr) {
+            map.put("sort", SortWhitelistUtil.sanitizeColumn(sortStr));
+        }
+        if (map.get("order") instanceof String orderStr) {
+            map.put("order", SortWhitelistUtil.sanitizeOrder(orderStr));
+        }
+    }
+
+}
diff --git a/novel-admin/src/main/java/com/java2nb/common/dao/DictDao.java b/novel-admin/src/main/java/com/java2nb/common/dao/DictDao.java
index 6fab6f6..c358fa8 100644
--- a/novel-admin/src/main/java/com/java2nb/common/dao/DictDao.java
+++ b/novel-admin/src/main/java/com/java2nb/common/dao/DictDao.java
@@ -1,5 +1,6 @@
 package com.java2nb.common.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
 import com.java2nb.common.domain.DictDO;
 
 import java.util.List;
@@ -19,7 +20,7 @@ public interface DictDao {
 
 	DictDO get(Long id);
 
-	List<DictDO> list(Map<String, Object> map);
+	List<DictDO> list(@ValidateSortOrder Map<String, Object> map);
 
 	int count(Map<String, Object> map);
 
diff --git a/novel-admin/src/main/java/com/java2nb/common/dao/FileDao.java b/novel-admin/src/main/java/com/java2nb/common/dao/FileDao.java
index 2aa5769..3dec742 100644
--- a/novel-admin/src/main/java/com/java2nb/common/dao/FileDao.java
+++ b/novel-admin/src/main/java/com/java2nb/common/dao/FileDao.java
@@ -1,5 +1,6 @@
 package com.java2nb.common.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
 import com.java2nb.common.domain.FileDO;
 
 import java.util.List;
@@ -18,7 +19,7 @@ public interface FileDao {
 
 	FileDO get(Long id);
 	
-	List<FileDO> list(Map<String,Object> map);
+	List<FileDO> list(@ValidateSortOrder Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/common/dao/GenColumnsDao.java b/novel-admin/src/main/java/com/java2nb/common/dao/GenColumnsDao.java
index 1985bbf..c5ee927 100644
--- a/novel-admin/src/main/java/com/java2nb/common/dao/GenColumnsDao.java
+++ b/novel-admin/src/main/java/com/java2nb/common/dao/GenColumnsDao.java
@@ -3,6 +3,7 @@ package com.java2nb.common.dao;
 import java.util.List;
 import java.util.Map;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
 import com.java2nb.common.domain.GenColumnsDO;
 import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Param;
@@ -19,7 +20,7 @@ public interface GenColumnsDao {
 
 	GenColumnsDO get(Long id);
 
-	List<GenColumnsDO> list(Map<String,Object> map);
+	List<GenColumnsDO> list(@ValidateSortOrder Map<String,Object> map);
 
 	int count(Map<String,Object> map);
 
diff --git a/novel-admin/src/main/java/com/java2nb/common/dao/LogDao.java b/novel-admin/src/main/java/com/java2nb/common/dao/LogDao.java
index e859984..7e3e42a 100644
--- a/novel-admin/src/main/java/com/java2nb/common/dao/LogDao.java
+++ b/novel-admin/src/main/java/com/java2nb/common/dao/LogDao.java
@@ -1,5 +1,6 @@
 package com.java2nb.common.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
 import com.java2nb.common.domain.LogDO;
 
 import java.util.List;
@@ -18,7 +19,7 @@ public interface LogDao {
 
 	LogDO get(Long id);
 	
-	List<LogDO> list(Map<String,Object> map);
+	List<LogDO> list(@ValidateSortOrder Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/common/utils/SortWhitelistUtil.java b/novel-admin/src/main/java/com/java2nb/common/utils/SortWhitelistUtil.java
new file mode 100644
index 0000000..2ca8300
--- /dev/null
+++ b/novel-admin/src/main/java/com/java2nb/common/utils/SortWhitelistUtil.java
@@ -0,0 +1,28 @@
+package com.java2nb.common.utils;
+
+import lombok.experimental.UtilityClass;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author xiongxiaoyang
+ * @date 2025/7/17
+ */
+@UtilityClass
+public class SortWhitelistUtil {
+
+    private final Set<String> allowedColumns = new HashSet<>(
+        Arrays.asList("id", "name", "create_time", "update_time", "order_num", "last_index_update_time", "word_count",
+            "visit_count"));
+    private final Set<String> allowedOrders = new HashSet<>(Arrays.asList("asc", "desc"));
+
+    public String sanitizeColumn(String input) {
+        return allowedColumns.contains(input.toLowerCase()) ? input.toLowerCase() : "id";
+    }
+
+    public String sanitizeOrder(String input) {
+        return allowedOrders.contains(input.toLowerCase()) ? input.toLowerCase() : "asc";
+    }
+}
\ No newline at end of file
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorCodeDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorCodeDao.java
index 3300858..2beee31 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorCodeDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorCodeDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.AuthorCodeDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface AuthorCodeDao {
 
 	AuthorCodeDO get(Long id);
 	
-	List<AuthorCodeDO> list(Map<String,Object> map);
+	List<AuthorCodeDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorDao.java
index 9dd6632..44daeaf 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/AuthorDao.java
@@ -1,5 +1,6 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
 import com.java2nb.novel.domain.AuthorDO;
 
 import java.util.Date;
@@ -19,7 +20,7 @@ public interface AuthorDao {
 
 	AuthorDO get(Long id);
 	
-	List<AuthorDO> list(Map<String,Object> map);
+	List<AuthorDO> list(@ValidateSortOrder Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/BookCommentDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/BookCommentDao.java
index 24dd6fd..7350a31 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/BookCommentDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/BookCommentDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.BookCommentDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface BookCommentDao {
 
 	BookCommentDO get(Long id);
 	
-	List<BookCommentDO> list(Map<String,Object> map);
+	List<BookCommentDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/BookContentDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/BookContentDao.java
index fcdcdfa..697340d 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/BookContentDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/BookContentDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.BookContentDO;
 import org.apache.ibatis.annotations.Mapper;
 
@@ -18,7 +20,7 @@ public interface BookContentDao {
 
     BookContentDO get(Long id);
 
-    List<BookContentDO> list(Map<String, Object> map);
+    List<BookContentDO> list(@ValidateSortOrder Map<String, Object> map);
 
     int count(Map<String, Object> map);
 
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/BookDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/BookDao.java
index bb4fa5f..7ccec2d 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/BookDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/BookDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.BookDO;
 import org.apache.ibatis.annotations.Mapper;
 
@@ -19,7 +21,7 @@ public interface BookDao {
 
     BookDO get(Long id);
 
-    List<BookDO> list(Map<String, Object> map);
+    List<BookDO> list(@ValidateSortOrder Map<String, Object> map);
 
     int count(Map<String, Object> map);
 
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/BookIndexDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/BookIndexDao.java
index 2536d92..56e70ff 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/BookIndexDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/BookIndexDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.BookIndexDO;
 import org.apache.ibatis.annotations.Mapper;
 
@@ -18,7 +20,7 @@ public interface BookIndexDao {
 
     BookIndexDO get(Long id);
 
-    List<BookIndexDO> list(Map<String, Object> map);
+    List<BookIndexDO> list(@ValidateSortOrder Map<String, Object> map);
 
     int count(Map<String, Object> map);
 
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/BookSettingDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/BookSettingDao.java
index 532a349..2cbb02f 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/BookSettingDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/BookSettingDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.BookSettingDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface BookSettingDao {
 
 	BookSettingDO get(Long id);
 	
-	List<BookSettingDO> list(Map<String,Object> map);
+	List<BookSettingDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/CategoryDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/CategoryDao.java
index 55139d3..d8c1904 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/CategoryDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/CategoryDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.CategoryDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface CategoryDao {
 
 	CategoryDO get(Integer id);
 	
-	List<CategoryDO> list(Map<String,Object> map);
+	List<CategoryDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/FriendLinkDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/FriendLinkDao.java
index d8b587c..e3698f6 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/FriendLinkDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/FriendLinkDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.FriendLinkDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface FriendLinkDao {
 
 	FriendLinkDO get(Integer id);
 	
-	List<FriendLinkDO> list(Map<String,Object> map);
+	List<FriendLinkDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/NewsDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/NewsDao.java
index 3366eef..c909ca9 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/NewsDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/NewsDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.NewsDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface NewsDao {
 
 	NewsDO get(Long id);
 	
-	List<NewsDO> list(Map<String,Object> map);
+	List<NewsDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/PayDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/PayDao.java
index acb672e..acb5aa9 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/PayDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/PayDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.PayDO;
 
 import java.util.Date;
@@ -19,7 +21,7 @@ public interface PayDao {
 
 	PayDO get(Long id);
 	
-	List<PayDO> list(Map<String,Object> map);
+	List<PayDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/UserDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/UserDao.java
index e641e61..d42d2a4 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/UserDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/UserDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.UserDO;
 import org.apache.ibatis.annotations.Mapper;
 
@@ -17,7 +19,7 @@ public interface UserDao {
 
     UserDO get(Long id);
 
-    List<UserDO> list(Map<String, Object> map);
+    List<UserDO> list(@ValidateSortOrder Map<String, Object> map);
 
     int count(Map<String, Object> map);
 
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/UserFeedbackDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/UserFeedbackDao.java
index 65b8744..a17eb60 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/UserFeedbackDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/UserFeedbackDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.UserFeedbackDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface UserFeedbackDao {
 
 	UserFeedbackDO get(Long id);
 	
-	List<UserFeedbackDO> list(Map<String,Object> map);
+	List<UserFeedbackDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/novel/dao/WebsiteInfoDao.java b/novel-admin/src/main/java/com/java2nb/novel/dao/WebsiteInfoDao.java
index f84ee58..9d646b9 100644
--- a/novel-admin/src/main/java/com/java2nb/novel/dao/WebsiteInfoDao.java
+++ b/novel-admin/src/main/java/com/java2nb/novel/dao/WebsiteInfoDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.novel.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.novel.domain.WebsiteInfoDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface WebsiteInfoDao {
 
 	WebsiteInfoDO get(Long id);
 	
-	List<WebsiteInfoDO> list(Map<String,Object> map);
+	List<WebsiteInfoDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/DataPermDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/DataPermDao.java
index 5651a23..ba2103f 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/DataPermDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/DataPermDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.DataPermDO;
 
 import java.util.List;
@@ -19,7 +21,7 @@ public interface DataPermDao {
 
 	DataPermDO get(Long id);
 	
-	List<DataPermDO> list(Map<String,Object> map);
+	List<DataPermDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/DeptDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/DeptDao.java
index 0b1a979..c2b11e2 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/DeptDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/DeptDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.DeptDO;
 
 import java.util.List;
@@ -19,7 +21,7 @@ public interface DeptDao {
 
 	DeptDO get(Long deptId);
 	
-	List<DeptDO> list(Map<String,Object> map);
+	List<DeptDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/MenuDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/MenuDao.java
index 454a03c..7d6ce8c 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/MenuDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/MenuDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.MenuDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface MenuDao {
 
 	MenuDO get(Long menuId);
 	
-	List<MenuDO> list(Map<String,Object> map);
+	List<MenuDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/RoleDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/RoleDao.java
index 21c3572..6e1d425 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/RoleDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/RoleDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.RoleDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface RoleDao {
 
 	RoleDO get(Long roleId);
 	
-	List<RoleDO> list(Map<String,Object> map);
+	List<RoleDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/RoleDataPermDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/RoleDataPermDao.java
index df978b0..5d4eb85 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/RoleDataPermDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/RoleDataPermDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.RoleDataPermDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface RoleDataPermDao {
 
 	RoleDataPermDO get(Long id);
 	
-	List<RoleDataPermDO> list(Map<String,Object> map);
+	List<RoleDataPermDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/RoleMenuDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/RoleMenuDao.java
index 6c07032..7625a0c 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/RoleMenuDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/RoleMenuDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.RoleMenuDO;
 
 import java.util.List;
@@ -18,7 +20,7 @@ public interface RoleMenuDao {
 
 	RoleMenuDO get(Long id);
 	
-	List<RoleMenuDO> list(Map<String,Object> map);
+	List<RoleMenuDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/SysUserDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/SysUserDao.java
index 4979a42..1bef4be 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/SysUserDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/SysUserDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.UserDO;
 
 import java.util.List;
@@ -19,7 +21,7 @@ public interface SysUserDao {
 
 	UserDO get(Long userId);
 	
-	List<UserDO> list(Map<String,Object> map);
+	List<UserDO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/java/com/java2nb/system/dao/UserRoleDao.java b/novel-admin/src/main/java/com/java2nb/system/dao/UserRoleDao.java
index b3c863f..10f385f 100644
--- a/novel-admin/src/main/java/com/java2nb/system/dao/UserRoleDao.java
+++ b/novel-admin/src/main/java/com/java2nb/system/dao/UserRoleDao.java
@@ -1,5 +1,7 @@
 package com.java2nb.system.dao;
 
+import com.java2nb.common.annotation.ValidateSortOrder;
+
 import com.java2nb.system.domain.UserRoleDO;
 
 import java.util.List;
@@ -19,7 +21,7 @@ public interface UserRoleDao {
 
 	UserRoleDO get(Long id);
 
-	List<UserRoleDO> list(Map<String, Object> map);
+	List<UserRoleDO> list(@ValidateSortOrder Map<String, Object> map);
 
 	int count(Map<String, Object> map);
 
diff --git a/novel-admin/src/main/resources/templates/common/generator/Dao.java.vm b/novel-admin/src/main/resources/templates/common/generator/Dao.java.vm
index 0964018..b3d5f41 100644
--- a/novel-admin/src/main/resources/templates/common/generator/Dao.java.vm
+++ b/novel-admin/src/main/resources/templates/common/generator/Dao.java.vm
@@ -18,7 +18,7 @@ public interface ${className}Dao {
 
 	${className}DO get(${pk.javaType} ${pk.attrname});
 	
-	List<${className}DO> list(Map<String,Object> map);
+	List<${className}DO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	int count(Map<String,Object> map);
 	
diff --git a/novel-admin/src/main/resources/templates/common/generator/Mapper.java.vm b/novel-admin/src/main/resources/templates/common/generator/Mapper.java.vm
index 1e70543..ffdbe09 100644
--- a/novel-admin/src/main/resources/templates/common/generator/Mapper.java.vm
+++ b/novel-admin/src/main/resources/templates/common/generator/Mapper.java.vm
@@ -44,7 +44,7 @@ public interface ${className}Mapper {
 			"limit #{offset}, #{limit}" + 
 			"</if>"+
 			"</script>")
-	List<${className}DO> list(Map<String,Object> map);
+	List<${className}DO> list(@ValidateSortOrder  Map<String,Object> map);
 	
 	@Select("<script>" +
 	"select count(*) from ${tableName} " + 
diff --git a/novel-common/pom.xml b/novel-common/pom.xml
index 097f40f..b57e4d4 100644
--- a/novel-common/pom.xml
+++ b/novel-common/pom.xml
@@ -22,6 +22,12 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
+        <!-- Aop 相关 -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-aop</artifactId>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-thymeleaf</artifactId>
diff --git a/novel-common/src/main/java/com/java2nb/novel/core/annotation/ValidateSortOrder.java b/novel-common/src/main/java/com/java2nb/novel/core/annotation/ValidateSortOrder.java
new file mode 100644
index 0000000..8f28787
--- /dev/null
+++ b/novel-common/src/main/java/com/java2nb/novel/core/annotation/ValidateSortOrder.java
@@ -0,0 +1,13 @@
+package com.java2nb.novel.core.annotation;
+
+import java.lang.annotation.*;
+
+/**
+ * @author xiongxiaoyang
+ * @date 2025/7/17
+ */
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface ValidateSortOrder {
+}
diff --git a/novel-common/src/main/java/com/java2nb/novel/core/aspect/SortOrderValidationAspect.java b/novel-common/src/main/java/com/java2nb/novel/core/aspect/SortOrderValidationAspect.java
new file mode 100644
index 0000000..9079126
--- /dev/null
+++ b/novel-common/src/main/java/com/java2nb/novel/core/aspect/SortOrderValidationAspect.java
@@ -0,0 +1,89 @@
+package com.java2nb.novel.core.aspect;
+
+import com.java2nb.novel.core.annotation.ValidateSortOrder;
+import com.java2nb.novel.core.utils.SortWhitelistUtil;
+import lombok.RequiredArgsConstructor;
+import lombok.SneakyThrows;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.stereotype.Component;
+
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.*;
+
+/**
+ * @author xiongxiaoyang
+ * @date 2025/7/17
+ */
+@Aspect
+@Component
+@RequiredArgsConstructor
+public class SortOrderValidationAspect {
+
+    /**
+     * 拦截所有的mapper方法
+     */
+    @SneakyThrows
+    @Around("execution(* com.java2nb.novel.mapper.*Mapper.*(..))")
+    public Object validateSortAndOrder(ProceedingJoinPoint joinPoint) {
+        Object[] args = joinPoint.getArgs();
+        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+        Method method = signature.getMethod();
+
+        Annotation[][] parameterAnnotations = method.getParameterAnnotations();
+
+        for (int i = 0; i < parameterAnnotations.length; i++) {
+            boolean hasAnnotation = Arrays.stream(parameterAnnotations[i])
+                .anyMatch(a -> a.annotationType().equals(ValidateSortOrder.class));
+
+            if (hasAnnotation && args[i] != null) {
+                processArgument(args[i]);
+            }
+        }
+
+        return joinPoint.proceed(args);
+    }
+
+    @SneakyThrows
+    private void processArgument(Object obj) {
+        if (obj instanceof Map<?,?> map) {
+            processMap(map);
+        } else {
+            traverseAndSanitize(obj);
+        }
+    }
+
+    @SneakyThrows
+    private void traverseAndSanitize(Object obj) {
+        for (Field field : obj.getClass().getDeclaredFields()) {
+            switch (field.getName()) {
+                case "sort", "order" -> {
+                    field.setAccessible(true);
+                    Object value = field.get(obj);
+                    if (value instanceof String strValue) {
+                        String sanitized = "sort".equals(field.getName())
+                            ? SortWhitelistUtil.sanitizeColumn(strValue)
+                            : SortWhitelistUtil.sanitizeOrder(strValue);
+                        field.set(obj, sanitized);
+                    }
+                }
+                default -> {
+                }
+            }
+        }
+    }
+
+    private void processMap(Map map) {
+        if (map.get("sort") instanceof String sortStr) {
+            map.put("sort", SortWhitelistUtil.sanitizeColumn(sortStr));
+        }
+        if (map.get("order") instanceof String orderStr) {
+            map.put("order", SortWhitelistUtil.sanitizeOrder(orderStr));
+        }
+    }
+
+}
diff --git a/novel-common/src/main/java/com/java2nb/novel/core/utils/SortWhitelistUtil.java b/novel-common/src/main/java/com/java2nb/novel/core/utils/SortWhitelistUtil.java
new file mode 100644
index 0000000..a9e3bae
--- /dev/null
+++ b/novel-common/src/main/java/com/java2nb/novel/core/utils/SortWhitelistUtil.java
@@ -0,0 +1,28 @@
+package com.java2nb.novel.core.utils;
+
+import lombok.experimental.UtilityClass;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author xiongxiaoyang
+ * @date 2025/7/17
+ */
+@UtilityClass
+public class SortWhitelistUtil {
+
+    private final Set<String> allowedColumns = new HashSet<>(
+        Arrays.asList("id", "name", "create_time", "update_time", "last_index_update_time", "word_count",
+            "visit_count"));
+    private final Set<String> allowedOrders = new HashSet<>(Arrays.asList("asc", "desc"));
+
+    public String sanitizeColumn(String input) {
+        return allowedColumns.contains(input.toLowerCase()) ? input.toLowerCase() : "id";
+    }
+
+    public String sanitizeOrder(String input) {
+        return allowedOrders.contains(input.toLowerCase()) ? input.toLowerCase() : "asc";
+    }
+}
\ No newline at end of file
diff --git a/novel-front/src/main/java/com/java2nb/novel/mapper/FrontBookMapper.java b/novel-front/src/main/java/com/java2nb/novel/mapper/FrontBookMapper.java
index b249821..28762b0 100644
--- a/novel-front/src/main/java/com/java2nb/novel/mapper/FrontBookMapper.java
+++ b/novel-front/src/main/java/com/java2nb/novel/mapper/FrontBookMapper.java
@@ -1,5 +1,6 @@
 package com.java2nb.novel.mapper;
 
+import com.java2nb.novel.core.annotation.ValidateSortOrder;
 import com.java2nb.novel.entity.Book;
 import com.java2nb.novel.vo.BookSpVO;
 import com.java2nb.novel.vo.BookVO;
@@ -13,7 +14,7 @@ import java.util.List;
 public interface FrontBookMapper extends BookMapper {
 
 
-    List<BookVO> searchByPage(BookSpVO params);
+    List<BookVO> searchByPage(@ValidateSortOrder BookSpVO params);
 
     void addVisitCount(@Param("bookId") Long bookId, @Param("visitCount") Integer visitCount);