You've forgotten to put in WHERE clause:
UPDATE account SET balance=balance-'$cost' WHERE username='steven' LIMIT 1;
What is happening in your query
UPDATE account SET balance=balance-'$cost' AND username='steven';
According to MySQL Operator Precedence, the substraction takes place first, which, for the example you gave, will return a positive number:
UPDATE account SET balance=(balance-'$cost') AND username='steven';
UPDATE account SET balance=(1700) AND username='steven';
Then, the assignment (=) of username to 'steven' takes place, which returns 'steven':
UPDATE account SET balance=(1700) AND (username='steven');
UPDATE account SET balance=(1700) AND ('steven');
Then, the (AND) boolean operator kicks in, converts both the positive number and the string to boolean values, both TRUE, and then ANDs them, which will return TRUE:
UPDATE account SET balance=((1700) AND ('steven'));
UPDATE account SET balance=(TRUE AND TRUE);
UPDATE account SET balance=(TRUE);
Finally, since balance is a floating point number, TRUE gets converted into a number, which defaults to to 1.0:
UPDATE account SET balance=(TRUE);
UPDATE account SET balance=1;
This will affect all records, not just the one for username 'steve'.