I am not seeing anywhere that the data needs to be sorted. If it does, just do it in the query like you already are.
If you can do a proper prepared statement, your second question should answer itself.
You are correct, I did not, but now I do. Thank you!