First problem I note is that you're using the [man]mysql[/man] extension which has been outdated and deprecated for some time now. Instead, you should be using something like [man]MySQLi[/man] or [man]PDO[/man]. See [man]mysqlinfo.api.choosing[/man] for more info.
Next major problem I see is that user-supplied input should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data (e.g. with [man]mysqli_real_escape_string/man for string data) or by using prepared statements.
Finally, note that you should always be checking to see if your SQL query was executed successfully before you attempt to do anything with it (or a result set you expect it to generate).
