Try it like this :
$sql = "UPDATE $tablename SET points = $points, $button = \"on\" WHERE username = \"$username\" ";
I suppose the points field is numeric and the rest are strings. If so ... escape with \" only the varchar and text fields.
Another usefull thing you could do is to Read The Fucking Manual
)))
www.mysql.com