Doesn't line 5 leave you open to malicious assignment of user_id?