No, it doesn't look right; if you're passing MySQL a string value, you must surround it with (single) quotes - just like PHP, HTML, etc. etc.
In addition, it appears as though you're vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query! Instead, sanitize it with a function such as [man]mysql_real_escape_string/man.