Nevermind on the parameter binding. Didn't know that `$user` is pgsql syntax.