(php , mysql) Contact us form mysql injection

For security, bind user supplied values when including them in a query.

Here's what that could look like using mysqli and the information provided https://www.php.net/manual/en/mysqli-stmt.bind-param.php

// renamed `textt` to `text`
$stmt = $mysqli->prepare('INSERT INTO `info` (`username`,`email`,`text`) VALUES (?,?,?);');
$stmt->bind_param($username, $email, $text);
$stmt->execute();
$stmt->close();

Here's what that would look like using PDO, should that connection be considered. https://www.php.net/manual/en/pdostatement.bindparam.php

Perhaps consider renaming your column textt to something more descriptive?

Also, normally, you'd want to provide some validation on user supplied input to prevent bots and help prevent user error.

e.g. for the email address:

if (filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
  $email = $_POST['email'];
} else {
  // often handled with a message or alert funciton
  echo 'Please enter a valid email';
  $error = true;
}

e.g. for the username:

if(!ctype_space($_POST['username'])) {
    $username = trim($_POST['username']);
} else {
    // as before often handled by a message/alert function
    echo 'Please provide a valid email address';
    $error = true;
}

It's often helpful to store the IP address of the requester. The following can be spoofed, and there are better functions out there, but it is often better than nothing.

$ip_address = $_SERVER['REMOTE_ADDR'];

There are solutions to help ensure it's not a bot completing your form, e.g. reCAPTCHA and honey pots. They're not always appropriate from a UX, UI, security standpoint, but I feel that should be mentioned as well.

I hope this was helpful!