“@ dfaf.fa”附近的语法错误MySql和PHP

I create a simple site for findID when I write the email.

HTML CODE

<form action="test.php" method="post">
        <input type="text" name="user_id_test" id="user_id_test">
        <br>
        <br>
        <input type="submit" value="Find ID">
</form>

PHP CODE

<?php

        //include database
        include 'include/db.inc';

        $emailUser = $_POST['user_id_test'];

        $findNewID = mysqli_query($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = $emailUser");

        if ($findNewID != "") {
            var_dump($findNewID);
            echo "$findNewID";
        } else {
            echo "Errore: " . $findNewID . "<br>" . mysqli_error($connessione) ."<br>";
        }

mysqli_error($connessione);

?>

I try to find ID for email: dfaf@dfaf.fa (it is in my database with ID 13) and I've this error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@dfaf.fa' at line 1

It is about passing email as integer, pass it as string..

  mysqli_query($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = $emailUser");    

 to

 mysqli_query($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = '".$emailUser."' ");

This would work but it is not safe to pass parameters within the queries directly, make the sql injection safe first...

This query is exposed to sql injections. Always sanitize or escape special characters in a string before using in a where clause. In this case wrap $email with quotes.

ie. change

$email to '".$emailUser."'

In the where clause.

You should use prepared statements to avoid this kind of errors and to avoid SQL Inyection:

$stmt = mysqli_prepare($connessione,"SELECT user_id FROM user_tmplt WHERE user_mail = ?");
if ( !$stmt ) { someErrorHandlingHere(); }

mysqli_stmt_bind_param($stmt, "s", $emailUser);
// same here: mysqli_stmt_bind_param may fail -> returns false

mysqli_stmt_execute($stmt);
// same here: mysqli_stmt_execute may fail -> returns false

mysqli_stmt_bind_result($stmt, $userId);
// and so on and on: error handling

mysqli_stmt_fetch($stmt);

echo "The user id es: {$userId}";

Your immediate problem (as has already been answered) is/was that you didn't mark the string parameter (the email-address) as a string literal within the SQL query. The MySQL server therefore interpreted it as an identifier (like a database/table/field name). And since @ is an invalid character within an identifier the server reported the error you've posted, see http://dev.mysql.com/doc/refman/5.0/en/identifier-qualifiers.html.

To mark a string literal within a query you put it (by default) in single-quotes:

 SELECT x FROM table WHERE y=z // compares the value of the field y with the value of the field z in each record
 SELECT x FROM table WHERE y='z' // compares the value of the field y with the string literal 'z' <- that's what you want

Anyway, here's an example (that addresses some other issues) using PDO instead of mysqli_*:

<?php
define('POST_FIELD_MAIL', 'user_id_test');

if ( !isset($_POST[POST_FIELD_MAIL]) ) { // maybe the resource (...script) has been requested without that parameter?
    trigger_error('missing parameter '.POST_FIELD_MAIL, E_USER_ERROR);
}
else {
    /** that's you part you probably want in inc/db.php */
    $pdo = new PDO('mysql:host=localhost;dbname=test;charset=utf8', 'localonly', 'localonly');  
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // that's why there's not error handling code after each and every call to a pdo function/method
    $pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
    /* ***** */

    try {
        $stmt = $pdo->prepare('SELECT user_id FROM user_tmplt WHERE user_mail=?'); // avoiding sql injections
        $stmt->execute( array($_POST[POST_FIELD_MAIL]) );

        $row = $stmt->fetch();
        if (!$row) {
            echo '<div>no such record</div>';
        }
        else {
            echo '<div>user_id=', htmlspecialchars($row['user_id']), '</div>';
        }
    }
    catch(PDOException $pex) {
        yourErrorHandler();
    }
}