diff --git a/lib/api.js b/lib/api.js
index 20b9ea2..1d8c7ab 100644
--- a/lib/api.js
+++ b/lib/api.js
@@ -499,7 +499,7 @@ secureRoutes.post('/changePassword', function (req, res) {
 });
 
 secureRoutes.post('/toggleEmail', function (req, res) {
-    global.mysql.query("UPDATE users SET enable_email = NOT enable_email WHERE id = ?", [hmac, req.decoded.id]).then(function () {
+    global.mysql.query("UPDATE users SET enable_email = NOT enable_email WHERE id = ?", [req.decoded.id]).then(function () {
         return res.json({'msg': 'Email toggled'});
     });
 });