This is my first program and I have done extensive research trying to answer this question and I can not solve the problem:

```
<?php

    include "connect.php";

    if (!$connection)
      {
      die('Could not connect: ' . mysql_error());
      }

    $submit = $_POST["submit"];

    if ($submit=="Submit") {
      $date = $_POST["date"];
      $name = $_POST["name"];
      $activity = $_POST["activity"];
      $activity_level = $_POST["activity_level"];

    $find_role = ("SELECT sales_role 
                     FROM role 
                LEFT JOIN USER on user.role_id = role.id 
                    WHERE user.user = '$name'");
    $find_activity_points = ("SELECT $activity_$role 
                                FROM $activity 
                               WHERE activity_level = '$activity_level'"); 

    $role = mysql_query($find_role);

    $activity_points = mysql_query($find_activity_points);
     if ($activity_points !== false) {
     }
      else {
       echo mysql_error ();
       die;
     }

     $convert_activity_points = array();

    while ($row = mysql_fetch_array($activity_points, MYSQL_ASSOC)) {
      $convert_activity_points[] = $row;
     }

    $set_points = "UPDATE $name SET $activity='$convert_activity_points' WHERE day='$date'";
     mysql_query($set_points);

    } 

    mysql_close($connection);

    ?>

```

And this is the error message that I get when I submit form.php to update.php:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FROM dial WHERE activity\_level='70'' at line 1

P.S. I know there are SQL injection vulnerabilities, but I am the only person using this program and I am using it locally on my computer. I'm okay with the vulnerabilities for now.

Edit: Changed code (I really appreciate the feedback)

```
$find_role = "SELECT sales_role FROM role LEFT JOIN USER on user.role_id=role.id WHERE user.user='$name'";

$find_activity_points = "SELECT %s_%s FROM $activity WHERE activity_level='%d'";    

list($role) = mysql_fetch_array(mysql_query($find_role));

 $activity_points = mysql_query(
     sprintf($find_activity_points, //the main string
         $activity, $role, $activity, $activity_level) //the "arguments"
  );    

    if ($activity_points !== false) {
    }
        else {
            echo mysql_error ();
            die;
    }

```

Updates the table with 0 and doesn't display an error msg. 
Re SQL injection vulnerabilities, see my original PS statement