DO NOT USE THE mysql_* FUNCTIONS!

They are DEPRECATED.

<?php if ($row_ranks['padric'] == '1' ) {
  echo ('<li><a href="padroncini_ric.php">Ricerca</a></li>');
      } 
      else  {
      echo ('<li><a href="#" class="disabled">Ricerca</a></li>');
      } 
?>

Your indentation style is a mess, decide what indentation style to use and if to use tabs or spaces (and if yes how many) and then stick to it:

<?php
    if ($row_ranks['padric'] == '1' ) {
        echo '<li><a href="padroncini_ric.php">Ricerca</a></li>';
    } else  {
        echo '<li><a href="#" class="disabled">Ricerca</a></li>';
    } 
?>

Normally there's also no space between the line and the closing semicolon.

Additionally the echo function does not need any parentheses.

if ($row_ranks['padric'] == '1' )

If your code is in your native language, please always convert it to English before posting it here for review. It makes things easier for us.

Now what you use here is called a magic string or magic number, it's a fixed value that has some meaning but does not provide any explanation what's-o-ever what that meaning is or why it is that way. Use named constants instead.

const SOME_CONDITION = "1"; // Change the name to something meaningful.

if ($row['padric'] == SOME_CONDITION) {

Also do you now the difference between the equality and identity operator? The equality operator == will perform casting as needed which can yield interesting effects, the identity operator === on the other hand will also compare the types.

Some examples:

0 == 0     -->  true
0 == "0"   -->  true
0 == ""    -->  true
0 == NULL  -->  true

0 === 0     -->  true
0 === "0"   -->  false
0 === ""    -->  false
0 === NULL  -->  false

So always sue === unless you have a compelling reason not to.

$_POST[$field] = '0' ;

First of all, global variables are bad. And after that, writing into the Super-Globals is a bad idea for many reasons. Nobody expects that super globals are modified in any way and that can lead to funny errors which you'll be looking for for days.

Extract the values from the super globals and work with that variable.

$updateSQL = sprintf("UPDATE ranks SET $field='".$_POST[$field]."' WHERE userID='".$_POST['ID']."'"); // set privileges for user

One word (okay, it's two): SQL Injection. There is no, absolutely no (and I mean no) excuse to allow SQL injection. Imagine somebody would manipulate the POST request to contain the value '; DROP TABLE ranks; -- which will yield the query:

UPDATE ranks SET field='field' WHERE userID=''; DROP TABLE ranks; --'

...any questions?

Why are you using sprintf here?

$row_RSfields = mysql_fetch_assoc($RSfields);
do {
    // code 
} while ($row_RSfields = mysql_fetch_assoc($RSfields));

Traditionally it's a while loop:

$result = getResult();
while ($row = fetchRow($result)) {

}

Now let's get to the core problem: You are using the mysql_* functions. You should either use mysqli_* or PDO.

Personally I prefer PDO over mysqli_* because it has an object oriented interface and support multi-statements. So here's an example on how to use PDO:

/**
 * 
 * @var PDO
 */
$pdo = new PDO($dsn, $user, $password, $options);
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); // See footnote!

/**
 *
 * @var PDOStatement
 */
$statement = $pdo->prepare("SELECT field FROM table WHERE id = :id;");
$statement->bindValue(":id", $id, PDO::PARAM_INT);

$statement->execute();

while ($row = $statement->fetch()) {
    echo $row['field'];
}

$statement->closeCursor();

Question on Stack Overflow about when to turn off emulated prepares.

Are you aware of the difference between strings?

'A simple string'
"A string with automatic $variable expansion"