In the database a customer has unique id which is defined below as idEmail = id, I am trying to find the customer in the database against this id and then replace their hashed password but I'm struggling with the SQL syntax as I'm not sure how I can give the "password" & "emailId" in the query a value rather than setting "password" to "password" where "id" = "emailId" and not the actual value of the emailId variable:

app.post("/reset_password/:id/:token", (req, res, next) => {
const { id, token} = req.params;
const idEmail = id;
const {password, password2} = req.body;
db.query("SELECT * FROM user WHERE id = ?", [idEmail], async (error, results) => {
if (id != results[0].id) {
  res.send("Invalid id" + id + results[0].id)
  return
}

const secret = JWT_SECRET + results[0].password
try {
  const payload = jwt.verify(token, secret)
  if (password === password2) {
    let hashedPassword = await bcrypt.hash(password, 8);
    
    db.query(
      "UPDATE user SET password = 'password' WHERE id = 'emailId' ",
      {
        password: hashedPassword,
        emailId: idEmail,
      },
      (error, results) => {
        if (error) {
          console.log(error);
        } else {