day and num as parameter *not tested*

I firmly believe that the tables name should not be variables,
so I add a column day (and index on it and id).
In the same time I added the num as a bind param (that should work)
The benefit is that if this two changes are made the sql query are constants
so 100% sure that there is no chance of sql injection