Replace your dots with underscores for $name and $surname, e.g. input_16_3. If you’re pulling things out of $_POST using rgpost instead is recommended (rgpost doc also shows how to access multi-input fields properly like the Name field).
Since you’re in gform_after_submission it would probably also be better to just pull your values out of the available $entry object instead using rgar, plenty of examples on how to extract values from the entry object in the gform_after_submission doc.
add_action( 'gform_after_submission_3', 'inserisci_tabella_vincitori_qr_code', 10, 2 );
function inserisci_tabella_vincitori_qr_code( $entry, $form ){
global $wpdb;
// recupero il valore del codice
$name = rgar( $entry, '16.3' );
$surname = rgar( $entry, '16.6' );
$telefono = rgar( $entry, '2' );
$provincia = rgar( $entry, '18' );
$query_update = "INSERT INTO inquadra_vincitori (name,surname, telefono, provincia) VALUES('$name','$surname','$telefono','$provincia')";
}
That should fix the blank values. I believe you have some security issues with that code. You may want to look into the $wpbd class documentation for better ways to do this: