title: SQL syntax: passing variable to SQL query
body: <p>This is my first program and I have done extensive research trying to answer this question and I can not solve the problem:</p>
  
  <pre><code>&lt;?php
  
      include "connect.php";
  
      if (!$connection)
        {
        die('Could not connect: ' . mysql_error());
        }
  
      $submit = $_POST["submit"];
  
      if ($submit=="Submit") {
        $date = $_POST["date"];
        $name = $_POST["name"];
        $activity = $_POST["activity"];
        $activity_level = $_POST["activity_level"];
  
      $find_role = ("SELECT sales_role 
                       FROM role 
                  LEFT JOIN USER on user.role_id = role.id 
                      WHERE user.user = '$name'");
      $find_activity_points = ("SELECT $activity_$role 
                                  FROM $activity 
                                 WHERE activity_level = '$activity_level'"); 
  
      $role = mysql_query($find_role);
  
      $activity_points = mysql_query($find_activity_points);
       if ($activity_points !== false) {
       }
        else {
         echo mysql_error ();
         die;
       }
  
       $convert_activity_points = array();
  
      while ($row = mysql_fetch_array($activity_points, MYSQL_ASSOC)) {
        $convert_activity_points[] = $row;
       }
  
  
  
      $set_points = "UPDATE $name SET $activity='$convert_activity_points' WHERE day='$date'";
       mysql_query($set_points);
  
  
      } 
  
      mysql_close($connection);
  
      ?&gt;
  </code></pre>
  
  <p>And this is the error message that I get when I submit form.php to update.php:
  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FROM dial WHERE activity_level='70'' at line 1</p>
  
  <p>P.S. I know there are SQL injection vulnerabilities, but I am the only person using this program and I am using it locally on my computer. I'm okay with the vulnerabilities for now.</p>
  
  <p>Edit: Changed code (I really appreciate the feedback)</p>
  
  <pre><code>$find_role = "SELECT sales_role FROM role LEFT JOIN USER on user.role_id=role.id WHERE user.user='$name'";
  
  $find_activity_points = "SELECT %s_%s FROM $activity WHERE activity_level='%d'";    
  
  list($role) = mysql_fetch_array(mysql_query($find_role));
  
   $activity_points = mysql_query(
       sprintf($find_activity_points, //the main string
           $activity, $role, $activity, $activity_level) //the "arguments"
    );    
  
      if ($activity_points !== false) {
      }
          else {
              echo mysql_error ();
              die;
      }
  </code></pre>
  
  <p>Updates the table with 0 and doesn't display an error msg. 
  Re SQL injection vulnerabilities, see my original PS statement</p>