“@ dfaf.fa”附近的语法错误MySql和PHP

Question

I create a simple site for findID when I write the email.

HTML CODE

<form action="test.php" method="post">
        <input type="text" name="user_id_test" id="user_id_test">
        <br>
        <br>
        <input type="submit" value="Find ID">
</form>

PHP CODE

<?php

        //include database
        include 'include/db.inc';

        $emailUser = $_POST['user_id_test'];

        $findNewID = mysqli_query($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = $emailUser");

        if ($findNewID != "") {
            var_dump($findNewID);
            echo "$findNewID";
        } else {
            echo "Errore: " . $findNewID . "<br>" . mysqli_error($connessione) ."<br>";
        }

mysqli_error($connessione);

?>

I try to find ID for email: [e-mail] (it is in my database with ID 13) and I've this error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@dfaf.fa' at line 1

Answer 1

It is about passing email as integer, pass it as string..

  mysqli_query($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = $emailUser");    

 to

 mysqli_query($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = '".$emailUser."' ");

This would work but it is not safe to pass parameters within the queries directly, make the sql injection safe first...