PHP security

//validation rules regular expression//
					//set $problem to flase - avoids overwriting
					$problem = FALSE;
					//set post items to shorter names
					if ($_POST['action'] == 'validate') {
					/******ALL FIELDS MUST BE COMPLETED*******/
					//input must be alpha, it can include spaces but must be at the longest 20 characters
						if (NULL || !eregi('^[a-zA-Z]|[ ]{20}$',stripslashes(trim($_POST['contactName'])))) {
							$problem = TRUE;
							$message .= '<p>The name you entered is not valid</p>';
							} else {
								$cn = escape_data($_POST['contactName']);
								}
					//input must be numeric, it can inlcude spaces but can be no longer than 11 characters
						if (NULL || !eregi('^[0-9]|[ ]{11}$',stripslashes(trim($_POST['contactPhone'])))){
							$problem = TRUE;
							$message .= '<p>The phone number you entered is not valid</p>';
							} else {
							$cp = escape_data($_POST['contactPhone']);
							}
					//input is alpha numeric, it cannot include spaces, it must have a @ followed by .co.uk,.com, .au or simmilar
						if (NULL || !eregi('^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.([a-zA-Z]{2,4})$',  
							stripslashes(trim($_POST['contactEmail'])))) {
							$problem = TRUE;
							$message .= '<p>The email address you entered is not valid</p>';
							} else {
							$ce = escape_data($_POST['contactEmail']);
							}
					//field can be alpha numeric, can hold spaces and punctuation.
						if (NULL || !eregi('^[a-zA-Z]|[ ]|[[:punct:]]{2,255}$',stripslashes(trim($_POST['contactEnquiry'])))) {
							$problem = TRUE;
							$message .= '<p>The enquiry you entered is not valid</p>';
							} else {
							$cenq = escape_data($_POST['contactEnquiry']);
							}
						//show the user the problems with there submissions//	
						if (!$problem){
						$sql = "INSERT INTO Enquiries (contactName, contactPhone, contactEmail, contactEnquiry) values ('$cn', '$cp', '$ce', '$cenq')";
						$result = mysql_query ($sql, $conn) or die(mysql_error());
						echo '<p>Thank you for your enquiry</p>';
						}

escape data()

function escape_data ($data) {

// Address Magic Quotes.
if (ini_get('magic_quotes_gpc')) {
	$data = stripslashes($data);
}

// Check for mysql_real_escape_string() support.
if (function_exists('mysql_real_escape_string')) {
	global $conn; // Need the connection.
	$data = mysql_real_escape_string (trim($data), $conn);
} else {
	$data = mysql_escape_string (trim($data));
}

// Return the escaped value.	
return $data;

} // End of function.

if is not secure how can be made so?