That's all you need to stop crawling the sortby URLs. The rules in robots.txt are naturally considered to be the start of a pattern so the final asterisk is not needed. And if you never need to see any query string indexed of any kind, then Disallow: /*.php? would do the job.
However, the noindex robots meta is also a good idea, since Google sometimes does index a URL even though they haven't crawled it.
Another step you could take is to use the feature in WebmasterTools where you tell Google which parameters to ignore.