get_user_by_id: handle illegal input