title: PHP mySQL query for updating row in table using variables
body: <p>My PHP file contains the following function.  It works when I set the review column to <code>'$review'</code> and the <code>IdUser</code> to 2.  But I need to have the <code>IdUser</code> set to the variable <code>$user</code>.  What is the correct syntax to set <code>IdUser</code> to the variable instead of a constant?  (preferably in a way that avoids SQL injection attacks). </p>
  
  <pre><code>function addRatings2($review, $user) {  
      //try to insert a new row in the "ratings" table with the given UserID
      $result = query("UPDATE ratings SET review ='$review' WHERE IdUser = 2 order by dateTime desc limit 1");    
  }
  </code></pre>