Bad code to handle image upload

I'm using this form to submit articles into the database:

<form enctype="multipart/form-data" method="post" action="add.php">

  <input name="title" type="text">
  <input name="image" type="file">
  <textarea name="text"></textarea>
  <input type="submit" name="go" value="Spremi">

</form>

include ("database.php"); 
$upload_path = "files/images/";
$prefix= date("Hi-mdY")."-";

$file_name = $HTTP_POST_FILES['image']['name'];
$file_name = str_replace(' ', '-', $file_name);
$file_name = str_replace('_', '-', $file_name);
$file_name = strtolower($file_name);

$upload_path = $upload_path . basename($prefix.$file_name);
move_uploaded_file($_FILES['image']['tmp_name'], $upload_path);

$final_file_name = ("/files/images/".$prefix.$file_name);
$date=date("Y.m.d");

$sql="INSERT INTO articles (title, image_link,  text, date) VALUES ('$_POST[title]', '$final_file_name', '$_POST[text]', '$date')"
if (mysql_query($sql)){
    echo "done";
} else {
    echo "error<br>" . mysql_error();
}

And here is the problem:

One of my friends told me that the PHP code in add.php is incorrect.

This is working for me, but can someone correct the code please.

EDIT:

Thanks guys, I've corrected the code :

<form enctype="multipart/form-data" method="post" action="">

  <input name="title" type="text">
  <input name="image" type="file">
  <textarea name="text"></textarea>
  <input type="submit" name="go" value="Submit">

</form>

<?php 
  if (isset($_POST['go'])){
    include ("database.php"); 
    $upload_path = "files/images/";
    $prefix= date("Hi-mdY")."-";

    $file_name = $_FILES['image']['name'];
    $file_name = str_replace(' ', '-', $file_name);
    $file_name = str_replace('_', '-', $file_name);
    $file_name = strtolower($file_name);

    $upload_path = $upload_path . basename($prefix.$file_name);
    move_uploaded_file($_FILES['image']['tmp_name'], $upload_path);

    $final_file_name = ("/files/images/".$prefix.$file_name);

    $title=$_POST['title'];
    $text=$_POST['text'];
    $date=date("Y.m.d");

    $title = mysql_real_escape_string($title);
    $final_file_name = mysql_real_escape_string($final_file_name);
    $text = mysql_real_escape_string($text);

    $sql="INSERT INTO articles (title, image_link,  text, date) VALUES ('$title', '$final_file_name', '$text', '$date')";
    if (mysql_query($sql)){
      echo "done";
    } else {
      echo "error<br>" . mysql_error();
    }
  }
?>

Now it's good?