The variable may not be escaped. I suggest you switch to using the PDO library because as of PHP 5.5, the MySQL native extension will be deprecated. PDO has many advantages over MySQL native such as prepared statements and named parameters. Prepare method will escape and also auto quote variables that you pass in. You won't have to worry about it anymore. Take a look at my rewrite of your current code:
$pdo = new PDO($dsn, $user, $password);
$values_array = array(
':first_name' => $first_name,
':last_name' => $last_name,
':pic' => $pic,
':birthday' => $birthday,
':industry' => $industry,
':languages' => $languages,
':summary' => $summary,
':email' => $email,
':positions' => $positions,
':skills' => $skills,
':publications' => $publications,
':volunteer' => $volunteer,
':location' => $location,
':awards' => $awards,
':certifications' => $certifications,
':interests' => $interests,
':education' => $education
);
$result = $pdo->prepare('INSERT INTO user (FirstName,LastName,Pic,Birthday,Industry,Languages,Summary,Email,Positions,Skills,Publications,Volunteer,Location,Awards,Certifications,Interests,Educations) values (:first_name,:last_name,:pic,:birthday,:industry,:languages,:summary,:email,:positions,:skills,:publications,:volunteer,:location,:awards,:certifications,:interests,:education)');
$result->execute($values_array);
You might want to consider switching to PDO for future proof.