in the code you posted, yo'ur missing the last double quote.
Anyways, I'm assuming you have more than just this, right? All you have there is a variable with a string. It's not actual executed until you run mysql_query() on the string.
$result = mysql_query($sql) or die(mysql_error());
If that still doesn't help, print $sql and take a look at what the string looks like prior to executing it.
Cgraz