php如果在里面，如果执行sql语句

the form already has an existing submit button which you can select difficulty(1st combo) and location(2nd combo) and then i submit this to display a video and a text field

under the field i have an addtional drop down box which is yes or no

then inside this code i want to submit a separate value using an if inisde an if it works fine on the 1st difficulty and location in the lists but nothing else and i cant see what im doing wrong a new pair of eyes would be great PS i will be upgrading this to PDO eventually

    <?php 
if(strpos($drop, 'norm') !== false && $ruavalue == 0) 
{
    Echo "RUA: ";
    $RUAresult = mysql_query("SELECT Answer FROM options"); 
    echo "<select name='ruacombo'>"; 
    while($RUArow = mysql_fetch_assoc($RUAresult)) 
    echo "<option value = '".$RUArow['Answer']."'>".$RUArow['Answer']."</option>";
    echo "</select>"; 
    echo '<form action="" method="post">';
    echo "<input name=\"boss\" type=hidden value=".$_POST['tier_two'].">";
    echo "<input name=\"main\" type=hidden value=".$_COOKIE['ID_my_site'].">";
    echo '<input type="submit" name="ruasubmit" value="RUA!" />';
    echo '</form>';
    if (isset($_POST['ruasubmit']))
     { 
        $ruaboss = $_POST['boss'];
        $ruauser = $_POST['main'];
        $ruasql = "UPDATE `RUASEXCELL` SET `$ruaboss`=1 WHERE Username = '$ruauser'";

        $add_rua = mysql_query($ruasql);

    }   

In your while loop, you need to access the associative array keys as a string like so:

while($RUArow = mysql_fetch_assoc($RUAresult)) 
    echo "<option value = '".$RUArow['Answer']."'>".$RUArow['Answer']."</option>"; 

Also, please look into using mysql_real_escape_string() to prevent SQL injection. In its current state, this script, and your database can be blown to pieces by a stray quote.