I'm not sure how PHP nulls transfer to SQL nulls, but setting it to the string "NULL"
will likely end up being treated as a string, which probably gets converted to 0 somewhere if it's being converted to a numeric type. You could try changing your PHP to this and see if it works, setting it to an actual PHP null instead of a string:
$user = !empty($user) ? $user : null;