Newbie Question $2

Dear List -

I have the following code:

The input from the form is a 10 digit string [1234567890] which is 
converted to phone number format [123-456-7890]

$phn = $_POST[phone];
  $phn = (string)$phn;
  $dsh = '-';
  $Phn = 
$phn[0].$phn[1].$phn[2].$dsh.$phn[3].$phn[4].$phn[5].$dsh.$phn[6].$phn[7].$phn[8].$phn[9]; 

     echo $Phn; // this is folded by Thunderbird.  In the script, it is 
//all on one line

     mysql_real_escape_string($Phn);
     $sql1 ='select Lname, Fname from Customers where Phone = $Phn ';
     echo $sql1; //this always shows $phn as Phn and not as a numerical 
//string.
     $result1 = mysqli_query($cxn, $sql1);

TIA

Ethan