use a lexical parameter for this. Assuming you have 2 bind parameters p_col and p_direction. Let the user choose the values for them out of LOVs. For p_col you could use something like select column_name from user_tab_columns where table_name = 'MYTABLE'
and for p_direction a static LOV with ACS and DESC
In the after param form trigger do something like :p_mysort := 'ORDER BY '||:p_col||' '||:p_direction
The parameter p_mysort create manual in the Navigator and add him in the query like: SELECT ....
I am implementing the same solution, and after adding the lexical parameter reference in the SQL statement and calling the report from Oracle Forms the report failed with the following error on the report server: