Certainly in an answer. It's just a poor answer if it contains an easily preventable vulnerability, but I would also point out the problem in a comment.
However, I wouldn't necessarily down vote the question on that reason alone, and I especially wouldn't down vote the question without providing any explanation of the injection vulnerability. On questions in the php section, I'm starting to work this information into my answer (sourced and modified from here for this) as a standard way to try to dissuade new php coders from exposing their code to such vulnerabilities.
Something similar could probably be worked into responses to other questions, although I avoid using this as my entire answer. Otherwise it's a fairly direct RTFM answer that may not directly help the original poster of the question.
Please don't use
mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process (see the red box). Instead, you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you care to learn, this is a good PDO tutorial.