update user set points=points-$cost where username=$username
okay I can help with this.
1) parenthesize all math - it technically isn't necessary but aids in readability and can sometimes add in execution speed as well.
2) unless username is a numeric field you need some quotes.
3) as a matter of style is helps set appart sql commands from field/table names it you use all caps for them.
so our new query is this
UPDATE user SET point = (points-$cost) WHERE username="$username"
4) in php is it a good idea to feed you sql into a variable so you can echo it out on a failure and see what is happening more clearly.
So the PHP is this
<?php
$sql = "UPDATE user SET point = (points-$cost) WHERE username=\"$username\"";
@mysql_query($sql) or die(mysql_errno() . ": " . mysql_error() . "<br />" . $sql);
?>