For one, you can just stick with using the $_GET array, especially since it's a superglobal variable.
Second, string values in SQL queries are denoted by single quotes, not double quotes.
Third, your script is vulnerable to SQL injection attacks; user-supplied data should never be placed directly into a SQL query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man.
EDIT: I forget that MySQL differs from other DBMS in the way it denotes identifiers. The double quotes in the query aren't likely causing a problem. Either way, try echo'ing out the query to see what it looks like.