select a value from a table with the help of php variable - php

Question

I am using a variable in my php code named $user_id. This variable takes a value after executing a short script of code. I also have a table named users in my database and this table holds user_id and email. If want to select email from my database, when the user_id from my table is equal to my variable named $user_id. Can I do this? This is my query:
<?php
//code ...
$user_id=$_GET['user']; //$user_id gets a value here
//now I want to select email from table users, where user_id is equal to variable $user_id
mysql_query(" SELECT `email` FROM `users` WHERE `user_id`='$user_id' ");
?>

Answer 1

Yes, it will work. I'd though advise you to use pdo or mysqli instead of mysql_* functions. They have been deprecated.
If for some reasons you can not switch to either of them; you should filter/sanitize your query.
Also, if user_id is a numeric field, you wouldn't be needing to enclose $user_id in quotes.

Answer 2

Your code has the basics, it just needs handling and I would add a couple of checks.
if(isset($_GET["user"]) && $_GET["user"] != "") //check there is a value for the user ID
{
if(is_int($_GET["user"]))
{
$user_id=$_GET["user"]);
$email="";
$q=mysql_query("SELECT email FROM users WHERE user_id={$user_id}") or die(mysql_error());
if(mysql_num_rows($q) > 0)
{
while($user=mysql_fetch_assoc($q))
{
$email=$user["email"];
}
}
else
{
echo "no users found";
}
}
else
{
echo "Not a valid user ID, please enter numeric value";
}
}
else
{
echo "No UserID";
}
hjpotter92 recommends that you use mysqli or pdo for questioning your database, which I would agree with although while learning keep with mysql as there are more resources available for learning, then when confident move onto newer technologies.
Please note: I have based this on the experience I feel the user has got with PHP and MySQL not on the most modern or best practices.

Answer 3

The code should be:
$email = '';
$res = mysqli_query(" SELECT `email` FROM `users` WHERE `user_id`='$user_id' ");
while ($temp = mysqli_fetch_assoc($res)) {
$email = $temp['email'];
}