1: Prepared statements. This code is very, very open to attacks because it does not sanitize any of the data other than the phone number.
2: Mysql_.
3: There is no such function error() or dbConnect. I assume these are defined in config.php.
4: Without knowing what error() does, i can only hope that it logs the error somewhere, and that the error logged is something more than just the string passed there.
5. Echoing 3 2 or 1 doesnt tell me anything; why not use that error() function you defined earlier?