Help with Adding User Submitted Content To DB

Here is my current code, currently it is not working, however it is giving me no errors so I'm stumped. Please note that I added some code because I was going to insert the users ip + name + email into a second table after I got the basic submission down. However it's been giving me too much grief so far so I haven't gone that far yet.

Also please note that the user takes a link to this page which carries the variable movie_id. This is a value to assign the submitted quote to a movie.

THe only part of my code that I was confused about was the incremental id value. I had no idea how to pass that so I set up a little counter system.
<?php include $_SERVER['DOCUMENT_ROOT'] . '/includes/db.inc.php'; ?>
<?php

$movie_id = $_GET['movieid']; //(passed variable)

$title = mysql_query("SELECT title FROM movies WHERE id = '$movie_id'");

while($row = mysql_fetch_array($title))
{
echo '<h1>' . "Your submitting a quote for " . $row['title'] . '</h1>';
}
?>


<table width="384" border="0" align="center">
<? echo '<tr><td colspan="2">'.$final_report.'</td></tr>';?>
Your Name:

<label>
<input name="username" type="text" id="username" size="30" border="1"/>
</label></td>
Your Email:

<label><input name="email" type="text" id="email" size="30" /> </label></td>

<form method="post">
Add Your Quote Here:
<td><input name="quote" type="text" id="quote" size="70"/></td>

<tr>
<td>&nbsp;</td>
<td><label>
<input name="register" type="submit" id="submit" value="submit" />
</label></td>
</tr>
</table>
<?php
$resultants = mysql_query("SELECT MAX(id) as max_id FROM quotes");
while($row = mysql_fetch_array($resultants))
{
$id = $row['max_id'] + 1;

}

if(isset($_POST['submit'])){
$quote = $_POST['quote'];
$ip = $_SERVER['REMOTE_ADDR'];

$create_member = mysql_query("INSERT INTO 'quotes' (`id`,`movie_id`, 'quote')
VALUES('$id','$movie_id', '$quote')");
$final_report.="Thank you for registering, you may login.";
echo '<h3>' . "Thank you your submission has been recieved!" . '</h3>';
}
?>

 

$create_member = mysql_query("INSERT INTO 'quotes' (`id`,`movie_id`, 'quote')
VALUES('$id','$movie_id', '$quote')"); 

PHP:

Should be

$create_member = mysql_query("INSERT INTO `quotes` (`id`, `movie_id`, `quote`)
VALUES('" . $id . "', '" . $movie_id . "', '" . $quote . "')") or die(mysql_error());

PHP:

You should also clean and sanitize all submitted data before inserting it into the database.

 

awesome thanks, and yeah that was my next step to protect against sql injections.